From 7d91359d3af00d521c99a7448d117730a5c85bda Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Date: Tue, 15 Oct 2019 15:12:18 +0200
Subject: [PATCH 1/4] ZOOKEEPER-3567: add SSL support for zkpython

---
 zookeeper-contrib/build-contrib.xml           |   6 +-
 .../zookeeper-contrib-zkpython/README         |   8 +-
 .../zookeeper-contrib-zkpython/build.xml      |   2 +-
 .../src/c/pyzk_docstrings.h                   |  27 ++++
 .../src/c/zookeeper.c                         |  44 +++++--
 .../src/python/setup.py                       |   4 +-
 .../src/test/connection_test.py               |  31 +++++
 .../src/test/gencerts.sh                      | 118 ++++++++++++++++++
 .../src/test/run_tests.sh                     |   5 +-
 .../src/test/zkServer.sh                      |  69 ++++++----
 .../src/test/zktestbase.py                    |   5 +-
 .../src/test/zoo.cfg                          |  14 +++
 12 files changed, 289 insertions(+), 44 deletions(-)
 create mode 100755 zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh
 create mode 100644 zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zoo.cfg

diff --git a/zookeeper-contrib/build-contrib.xml b/zookeeper-contrib/build-contrib.xml
index 70bb8644f52..681db2d763e 100644
--- a/zookeeper-contrib/build-contrib.xml
+++ b/zookeeper-contrib/build-contrib.xml
@@ -32,7 +32,7 @@
 
   <property name="lib.dir"  location="${zk.root}/zookeeper-server/src/main/resources/lib"/>
 
-  <property name="build.dir" location="${zk.root}/build/zookeeper-contrib/zookeeper-contrib-${name}"/>
+  <property name="build.dir" location="${zk.root}/zookeeper-contrib/zookeeper-contrib-${name}/target"/>
   <property name="build.classes" location="${build.dir}/classes"/>
   <property name="build.test" location="${build.dir}/test"/>
 
@@ -179,7 +179,7 @@
       <!-- we can't use id=classpath, because available fails if fileset directory
            doesn't exist -->
       <classpath>
-        <pathelement location="${zk.root}/build/classes"/>
+        <pathelement location="${zk.root}/zookeeper-server/target/classes"/>
       </classpath>
     </available>
   </target>
@@ -190,7 +190,7 @@
 
 
   <target name="checkMainTestIsAvailable">
-    <available file="${zk.root}/build/test/classes/org/apache/zookeeper/test/ClientBase.class"
+    <available file="${zk.root}/zookeeper-server/target/test-classes/org/apache/zookeeper/test/ClientBase.class"
                property="mainTestIsCompiled">
     </available>
   </target>
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/README b/zookeeper-contrib/zookeeper-contrib-zkpython/README
index 89d99989756..56154618356 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/README
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/README
@@ -7,14 +7,18 @@ DEPENDENCIES:
 
 This has only been tested against SVN (i.e. 3.2.0 in development) but should work against 3.1.1. 
 
-You will need the Python development headers installed to build the module - on many package-management systems, these can be found in python-devel.
+You will need the Python development headers installed to build the module - on many package-management systems, these can be found in python-devel. (On ubuntu 18.4, install python2.7 and python2.7-dev.)
 
 Python >= 2.6 is required. We have tested against 2.6. We have not tested against 3.x. 
 
+E.g. setting up tpyhon and python devel on ubuntu 18.4:
+sudo apt-get install python2.7 python2.7-dev
+sudo update-alternatives --install /usr/bin/python python /usr/bin/python2.7 1
+
 BUILD AND INSTALL:
 -------------------
 
-To install, make sure that the C client has been built and that the libraries are installed in /usr/local/lib (or change this directory in setup.py). Then run:
+To install, make sure that the C client has been built (use `mvn clean install -DskipTests -Pfull-build` in the root folder of zookeeper) or that the zookeeper C libraries are installed in /usr/local/lib (or change this directory in setup.py). Then run:
 
 ant install
 
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/build.xml b/zookeeper-contrib/zookeeper-contrib-zkpython/build.xml
index c229deec654..99f634abe81 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/build.xml
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/build.xml
@@ -20,10 +20,10 @@
 <project name="zkpython" default="install">
   <import file="../build-contrib.xml"/>
   <property name="python.src.dir" value="src/python"/>
-  <property name="test.build.dir" value="build/test/" />
   <property name="test.src.dir" value="src/test"/>
   <property name="test.log.dir" value="${build.test}/logs" />
   <property name="test.output" value="no" />
+  <property name="test.output" value="no" />
   <property name="test.timeout" value="900000" />
 
   <target name="test"
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/pyzk_docstrings.h b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/pyzk_docstrings.h
index 1f38d53fc74..2e6fd1e8f6f 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/pyzk_docstrings.h
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/pyzk_docstrings.h
@@ -568,6 +568,33 @@ static const char pyzk_init_doc[] =
 " an integer handle. If it fails to create \n"
 " a new zhandle the function throws an exception.\n";
 
+static const char pyzk_init_ssl_doc[] =
+"This method creates a new handle and a zookeeper SSL session that corresponds\n"
+"to that handle. Session establishment is asynchronous, meaning that the\n"
+"session should not be considered established until (and unless) an\n"
+"event of state CONNECTED_STATE is received.\n"
+"PARAMETERS:\n"
+" host: comma separated host:port pairs, each corresponding to a zk\n"
+"  server. e.g. '127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002'\n"
+" cert_str: SSL certificate string e.g. 'server.cert,client.cert,client-priv-key.pom,passwd'\n"
+"\n"
+"(subsequent parameters are optional)\n"
+" fn: the global watcher callback function. When notifications are\n"
+"  triggered this function will be invoked.\n"
+" recv_timeout: \n"
+" (clientid, passwd)\n"
+" clientid the id of a previously established session that this\n"
+"  client will be reconnecting to. Clients can access the session id of an established, valid,\n"
+"  connection by calling zoo_client_id. If\n"
+"  the specified clientid has expired, or if the clientid is invalid for \n"
+"  any reason, the returned zhandle_t will be invalid -- the zhandle_t \n"
+"  state will indicate the reason for failure (typically\n"
+"  EXPIRED_SESSION_STATE).\n"
+"\n"
+"RETURNS:\n"
+" an integer handle. If it fails to create \n"
+" a new zhandle the function throws an exception.\n";
+
 static const char pyzk_get_doc[] = 
 " gets the data associated with a node synchronously.\n"
 "\n"
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
index add1e9b3696..7479510c3c8 100644
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/c/zookeeper.c
@@ -599,12 +599,13 @@ void acl_completion_dispatch(int rc, struct ACL_vector *acl, struct Stat *stat,
 /* ZOOKEEPER API IMPLEMENTATION */
 /* -------------------------------------------------------------------------- */
 
-static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
-{
+
+static PyObject *pyzookeeper_init_optional_ssl(PyObject *self, PyObject *args, int ssl) {
   const char *host;
+  const char *cert_str;
   PyObject *watcherfn = Py_None;
+  zhandle_t *zh = NULL;
   int recv_timeout = 10000;
-  //  int clientid = -1;
   clientid_t cid;
   cid.client_id = -1;
   const char *passwd;
@@ -621,9 +622,14 @@ static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
     return NULL;
   }
 
-  if (!PyArg_ParseTuple(args, "s|Oi(Ls)", &host, &watcherfn, &recv_timeout, &cid.client_id, &passwd)) 
-    return NULL;
-  
+  if (ssl) {
+    if (!PyArg_ParseTuple(args, "ss|Oi(Ls)", &host, &cert_str, &watcherfn, &recv_timeout, &cid.client_id, &passwd))
+      return NULL;
+  } else {
+    if (!PyArg_ParseTuple(args, "s|Oi(Ls)", &host, &watcherfn, &recv_timeout, &cid.client_id, &passwd))
+        return NULL;
+  }
+
   if (cid.client_id != -1) {
     strncpy(cid.passwd, passwd, 16*sizeof(char));
   }
@@ -635,14 +641,18 @@ static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
     }
   }
   watchers[handle] = pyw;
-  zhandle_t *zh = zookeeper_init( host, watcherfn != Py_None ? watcher_dispatch : NULL, 
-                                  recv_timeout, cid.client_id == -1 ? 0 : &cid, 
-                                  pyw,
-                                  0 ); 
+
+  if (ssl) {
+    zh = zookeeper_init_ssl( host, cert_str, watcherfn != Py_None ? watcher_dispatch : NULL,
+                             recv_timeout, cid.client_id == -1 ? 0 : &cid, pyw, 0 );
+  } else {
+    zh = zookeeper_init( host, watcherfn != Py_None ? watcher_dispatch : NULL,
+                         recv_timeout, cid.client_id == -1 ? 0 : &cid, pyw, 0 );
+  }
 
   if (zh == NULL)
     {
-      PyErr_SetString( ZooKeeperException, "Could not internally obtain zookeeper handle" );
+      PyErr_SetString( ZooKeeperException, "Could not internally obtain SSL zookeeper handle" );
       return NULL;
     }
 
@@ -650,6 +660,17 @@ static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
   return Py_BuildValue( "i", handle);
 }
 
+static PyObject *pyzookeeper_init(PyObject *self, PyObject *args)
+{
+  return pyzookeeper_init_optional_ssl(self, args, 0);
+}
+
+
+static PyObject *pyzookeeper_init_ssl(PyObject *self, PyObject *args)
+{
+  return pyzookeeper_init_optional_ssl(self, args, 1);
+}
+
 
 /* -------------------------------------------------------------------------- */
 /* Asynchronous API implementation */
@@ -1497,6 +1518,7 @@ PyObject *pyzoo_deterministic_conn_order(PyObject *self, PyObject *args)
 
 static PyMethodDef ZooKeeperMethods[] = {
   {"init", pyzookeeper_init, METH_VARARGS, pyzk_init_doc },
+  {"init_ssl", pyzookeeper_init_ssl, METH_VARARGS, pyzk_init_ssl_doc },
   {"create",pyzoo_create, METH_VARARGS, pyzk_create_doc },
   {"delete",pyzoo_delete, METH_VARARGS, pyzk_delete_doc },
   {"get_children", pyzoo_get_children, METH_VARARGS, pyzk_get_children_doc },
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
index c64889e0312..313c020569c 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/python/setup.py
@@ -21,11 +21,11 @@
 zookeepermodule = Extension("zookeeper",
                             sources=["src/c/zookeeper.c"],
                             include_dirs=[zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/include",
-                                          zookeeper_basedir + "/build/c",
+                                          zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/target/c",
                                           zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/generated"],
                             libraries=["zookeeper_mt"],
                             library_dirs=[zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/.libs/",
-                                          zookeeper_basedir + "/build/c/.libs/",
+                                          zookeeper_basedir + "/zookeeper-client/zookeeper-client-c/target/c/.libs/",
                                           zookeeper_basedir + "/build/test/test-cppunit/.libs",
                                           "/usr/local/lib"
                                           ])
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
index 3913fe3b7d9..2661e6ecaf8 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/connection_test.py
@@ -58,6 +58,37 @@ def connection_watcher(handle, type, state, path):
                           self.handle,
                           "/")
 
+
+    def testsslconnection(self):
+        cv = threading.Condition()
+        self.connected = False
+        def connection_watcher(handle, type, state, path):
+            cv.acquire()
+            self.connected = True
+            self.assertEqual(zookeeper.CONNECTED_STATE, state)
+            self.handle = handle
+            cv.notify()
+            cv.release()
+
+        cv.acquire()
+        ret = zookeeper.init_ssl(self.sslhost, self.sslcert, connection_watcher)
+        cv.wait(15.0)
+        cv.release()
+        self.assertEqual(self.connected, True, "SSL Connection timed out to " + self.host)
+        self.assertEqual(zookeeper.CONNECTED_STATE, zookeeper.state(self.handle))
+
+        self.assertEqual(zookeeper.close(self.handle), zookeeper.OK)
+        # Trying to close the same handle twice is an error, and the C library will segfault on it
+        # so make sure this is caught at the Python module layer
+        self.assertRaises(zookeeper.ZooKeeperException,
+                          zookeeper.close,
+                          self.handle)
+
+        self.assertRaises(zookeeper.ZooKeeperException,
+                          zookeeper.get,
+                          self.handle,
+                          "/")
+
     def testhandlereuse(self):
         """
         Test a) multiple concurrent connections b) reuse of closed handles
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh
new file mode 100755
index 00000000000..77f013c2dbf
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#
+# This script cleans up old transaction logs and snapshots
+#
+
+#
+# If this scripted is run out of /usr/bin or some other system bin directory
+# it should be linked to and not copied. Things like java jar files are found
+# relative to the canonical path of this script.
+#
+
+# Generate the root key
+openssl genrsa -out rootkey.pem 2048
+
+#Generate the root Cert
+openssl req -x509 -new -key rootkey.pem -out root.crt -config <(
+cat <<-EOF
+[ req ]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+
+[ dn ]
+C = US
+ST = California
+L = San Francisco
+O = Bookkeeper
+emailAddress = dev@bookkeeper.apache.org
+CN = bookkeeper.apache.org
+EOF
+)
+
+#Generate Client Key
+openssl genrsa -out clientkey.pem 2048
+
+#Generate Client Cert
+openssl req -new -key clientkey.pem -out client.csr -config <(
+cat <<-EOF
+[ req ]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+
+[ dn ]
+C = US
+ST = California
+L = San Francisco
+O = Bookkeeper
+emailAddress = dev@bookkeeper.apache.org
+CN = bookkeeper.apache.org
+EOF
+)
+openssl x509 -req -in client.csr -CA root.crt -CAkey rootkey.pem -CAcreateserial -days 3650 -out client.crt
+
+#Export in pkcs12 format
+openssl pkcs12 -export -in client.crt -inkey clientkey.pem -out client.pkcs12 -password pass:password
+
+# Import Keystore in JKS
+keytool -importkeystore -srckeystore client.pkcs12 -destkeystore client.jks -srcstoretype pkcs12 -srcstorepass password -deststorepass password
+
+############################################################
+
+#Generate Server key
+openssl genrsa -out serverkey.pem 2048
+
+#Generate Server Cert
+openssl req -new -key serverkey.pem -out server.csr -config <(
+cat <<-EOF
+[ req ]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+
+[ dn ]
+C = US
+ST = California
+L = San Francisco
+O = Bookkeeper
+emailAddress = dev@bookkeeper.apache.org
+CN = bookkeeper.apache.org
+EOF
+)
+openssl x509 -req -in server.csr -CA root.crt -CAkey rootkey.pem -CAcreateserial -days 3650 -out server.crt
+
+#Export in pkcs12 format
+openssl pkcs12 -export -in server.crt -inkey serverkey.pem -out server.pkcs12 -password pass:password
+
+# Import Keystore in JKS
+keytool -importkeystore -srckeystore server.pkcs12 -destkeystore server.jks -srcstoretype pkcs12 -srcstorepass password -deststorepass password
+
+
+keytool -importcert -keystore server.jks -file root.crt -storepass password -noprompt
+
+keytool -importcert -alias ca -file root.crt -keystore clienttrust.jks -storepass password -noprompt
+
+keytool -importcert -alias clientcert -file client.crt -keystore clienttrust.jks -storepass password -noprompt
+
+keytool -importcert -alias ca -file root.crt -keystore servertrust.jks -storepass password -noprompt
+keytool -importcert -alias servercert -file server.crt -keystore servertrust.jks -storepass password -noprompt
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
index 91e5b57d2f0..a3cf4d87969 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/run_tests.sh
@@ -30,11 +30,12 @@ else
 fi
 
 # Find the build directory containing zookeeper.so
-SO_PATH=`find ../../build/ -name "zookeeper.so" | head -1`
+SO_PATH=`find ./target/ -name "zookeeper.so" | head -1`
 PYTHONPATH=`dirname $SO_PATH`
-LIB_PATH=../../build/c/.libs/:../../build/test/test-cppunit/.libs
+LIB_PATH=../../zookeeper-client/zookeeper-client-c/target/c/.libs
 for test in `ls $1/*_test.py`; 
 do
     echo "Running $test"
+    echo "Running LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test"
     LD_LIBRARY_PATH=$LIB_PATH:$LD_LIBRARY_PATH DYLD_LIBRARY_PATH=$LIB_PATH:$DYLD_LIBRARY_PATH PYTHONPATH=$PYTHONPATH python $test
 done
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
index a4638de3f31..5e44e92803e 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
@@ -18,36 +18,56 @@
 
 if [ "x$1" == "x" ]
 then
-    echo "USAGE: $0 startClean|start|stop hostPorts"
+    echo "USAGE: $0 startClean|start|stop"
     exit 2
 fi
 
-if [ "x$1" == "xstartClean" ]
+if [ "x${base_dir}" == "x" ]
+then
+  PROJECT_ROOT="../../"
+else
+  PROJECT_ROOT=${base_dir}
+fi
+WORK_DIR=${PROJECT_ROOT}/zookeeper-contrib/zookeeper-contrib-zkpython/target/zkpython_tests
+TEST_DIR=${PROJECT_ROOT}/zookeeper-contrib/zookeeper-contrib-zkpython/src/test
+
+
+if [ -r "${WORK_DIR}/../zk.pid" ]
 then
-    if [ "x${base_dir}" == "x" ]
+  pid=`cat "${WORK_DIR}/../zk.pid"`
+  kill -9 $pid
+  rm -f "${WORK_DIR}/../zk.pid"
+fi
+
+which lsof &> /dev/null
+if [ $? -eq 0  ]
+then
+    pid=`lsof -i :22182 | grep LISTEN | awk '{print $2}'`
+    if [ -n "$pid" ]
     then
-    rm -rf /tmp/zkdata
-    else
-    rm -rf ${base_dir}/build/tmp
+        kill -9 $pid
     fi
 fi
 
-if [ "x${base_dir}" == "x" ]	
+
+
+
+if [ "x$1" == "xstartClean" ]
 then
-zk_base="../../"
-else
-zk_base="${base_dir}"
+    rm -rf ${WORK_DIR}
 fi
 
-CLASSPATH="$CLASSPATH:${zk_base}/build/classes"
+
+
+CLASSPATH="$CLASSPATH:${PROJECT_ROOT}/zookeeper-server/target/classes"
 CLASSPATH="$CLASSPATH:${zk_base}/conf"
 
-for i in "${zk_base}"/build/lib/*.jar
+for i in "${PROJECT_ROOT}"/zookeeper-server/target/lib/*.jar
 do
     CLASSPATH="$CLASSPATH:$i"
 done
 
-for i in "${zk_base}"/zookeeper-server/src/main/resource/lib/*.jar
+for i in "${PROJECT_ROOT}"/zookeeper-server/src/main/resource/lib/*.jar
 do
     CLASSPATH="$CLASSPATH:$i"
 done
@@ -57,15 +77,20 @@ done
 
 case $1 in
 start|startClean)
-    if [ "x${base_dir}" == "x" ]
-        then
-        mkdir -p /tmp/zkdata
-        java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22182 /tmp/zkdata &> /tmp/zk.log &
-        else
-        mkdir -p ${base_dir}/build/tmp/zkdata
-        java -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain 22182 ${base_dir}/build/tmp/zkdata &> ${base_dir}/build/tmp/zk.log &
-    fi
-        sleep 5
+    mkdir -p ${WORK_DIR}/zkdata
+
+    rm -rf ${WORK_DIR}/ssl
+    mkdir -p ${WORK_DIR}/ssl
+    cp ${TEST_DIR}/gencerts.sh ${WORK_DIR}/ssl/
+    cd ${WORK_DIR}/ssl/
+    ./gencerts.sh
+    cd -
+
+    sed "s#WORKDIR#${WORK_DIR}#g" ${TEST_DIR}/zoo.cfg > "${WORK_DIR}/zoo.cfg"
+    java  -Dzookeeper.extendedTypesEnabled=true -Dznode.container.checkIntervalMs=100 -cp $CLASSPATH org.apache.zookeeper.server.ZooKeeperServerMain "${WORK_DIR}/zoo.cfg" &> "${WORK_DIR}/zoo.log" &
+    pid=$!
+    echo -n $! > ${WORK_DIR}/../zk.pid
+    sleep 5
     ;;
 stop)
     # Already killed above
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zktestbase.py b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zktestbase.py
index 8229418e3e7..cafbec56669 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zktestbase.py
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zktestbase.py
@@ -22,10 +22,13 @@
 
 class TestBase(unittest.TestCase):
     SERVER_PORT = 22182
-    
+    SERVER_SSL_PORT = 22183
+
     def __init__(self,methodName='runTest'):
         unittest.TestCase.__init__(self,methodName)
         self.host = "localhost:%d" % self.SERVER_PORT
+        self.sslhost = "localhost:%d" % self.SERVER_SSL_PORT
+        self.sslcert =  "./target/zkpython_tests/ssl/server.crt,./target/zkpython_tests/ssl/client.crt,./target/zkpython_tests/ssl/clientkey.pem,password"
         self.connected = False
         self.handle = -1
         logdir = os.environ.get("ZKPY_LOG_DIR")
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zoo.cfg b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zoo.cfg
new file mode 100644
index 00000000000..2d4fc31d9fd
--- /dev/null
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zoo.cfg
@@ -0,0 +1,14 @@
+tickTime=500
+initLimit=10
+syncLimit=5
+dataDir=WORKDIR/zkdata
+maxClientCnxns=200
+
+clientPort=22182
+secureClientPort=22183
+serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
+ssl.keyStore.location=WORKDIR/ssl/server.jks
+ssl.keyStore.password=password
+ssl.trustStore.location=WORKDIR/ssl/servertrust.jks
+ssl.trustStore.password=password
+

From 0150986da77823b6181aefb0eb33e2eea3d5bfd9 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Date: Wed, 16 Oct 2019 13:00:02 +0200
Subject: [PATCH 2/4] ZOOKEEPER-3567: removing code duplication: re-use test
 SSL certificate generator from C-client tests

---
 .../src/test/gencerts.sh                      | 118 ------------------
 .../src/test/zkServer.sh                      |   2 +-
 2 files changed, 1 insertion(+), 119 deletions(-)
 delete mode 100755 zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh

diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh
deleted file mode 100755
index 77f013c2dbf..00000000000
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/gencerts.sh
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/usr/bin/env bash
-
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements.  See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License.  You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#
-# This script cleans up old transaction logs and snapshots
-#
-
-#
-# If this scripted is run out of /usr/bin or some other system bin directory
-# it should be linked to and not copied. Things like java jar files are found
-# relative to the canonical path of this script.
-#
-
-# Generate the root key
-openssl genrsa -out rootkey.pem 2048
-
-#Generate the root Cert
-openssl req -x509 -new -key rootkey.pem -out root.crt -config <(
-cat <<-EOF
-[ req ]
-default_bits = 2048
-prompt = no
-default_md = sha256
-distinguished_name = dn
-
-[ dn ]
-C = US
-ST = California
-L = San Francisco
-O = Bookkeeper
-emailAddress = dev@bookkeeper.apache.org
-CN = bookkeeper.apache.org
-EOF
-)
-
-#Generate Client Key
-openssl genrsa -out clientkey.pem 2048
-
-#Generate Client Cert
-openssl req -new -key clientkey.pem -out client.csr -config <(
-cat <<-EOF
-[ req ]
-default_bits = 2048
-prompt = no
-default_md = sha256
-distinguished_name = dn
-
-[ dn ]
-C = US
-ST = California
-L = San Francisco
-O = Bookkeeper
-emailAddress = dev@bookkeeper.apache.org
-CN = bookkeeper.apache.org
-EOF
-)
-openssl x509 -req -in client.csr -CA root.crt -CAkey rootkey.pem -CAcreateserial -days 3650 -out client.crt
-
-#Export in pkcs12 format
-openssl pkcs12 -export -in client.crt -inkey clientkey.pem -out client.pkcs12 -password pass:password
-
-# Import Keystore in JKS
-keytool -importkeystore -srckeystore client.pkcs12 -destkeystore client.jks -srcstoretype pkcs12 -srcstorepass password -deststorepass password
-
-############################################################
-
-#Generate Server key
-openssl genrsa -out serverkey.pem 2048
-
-#Generate Server Cert
-openssl req -new -key serverkey.pem -out server.csr -config <(
-cat <<-EOF
-[ req ]
-default_bits = 2048
-prompt = no
-default_md = sha256
-distinguished_name = dn
-
-[ dn ]
-C = US
-ST = California
-L = San Francisco
-O = Bookkeeper
-emailAddress = dev@bookkeeper.apache.org
-CN = bookkeeper.apache.org
-EOF
-)
-openssl x509 -req -in server.csr -CA root.crt -CAkey rootkey.pem -CAcreateserial -days 3650 -out server.crt
-
-#Export in pkcs12 format
-openssl pkcs12 -export -in server.crt -inkey serverkey.pem -out server.pkcs12 -password pass:password
-
-# Import Keystore in JKS
-keytool -importkeystore -srckeystore server.pkcs12 -destkeystore server.jks -srcstoretype pkcs12 -srcstorepass password -deststorepass password
-
-
-keytool -importcert -keystore server.jks -file root.crt -storepass password -noprompt
-
-keytool -importcert -alias ca -file root.crt -keystore clienttrust.jks -storepass password -noprompt
-
-keytool -importcert -alias clientcert -file client.crt -keystore clienttrust.jks -storepass password -noprompt
-
-keytool -importcert -alias ca -file root.crt -keystore servertrust.jks -storepass password -noprompt
-keytool -importcert -alias servercert -file server.crt -keystore servertrust.jks -storepass password -noprompt
diff --git a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
index 5e44e92803e..3b6ed37fc12 100755
--- a/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
+++ b/zookeeper-contrib/zookeeper-contrib-zkpython/src/test/zkServer.sh
@@ -81,7 +81,7 @@ start|startClean)
 
     rm -rf ${WORK_DIR}/ssl
     mkdir -p ${WORK_DIR}/ssl
-    cp ${TEST_DIR}/gencerts.sh ${WORK_DIR}/ssl/
+    cp ${PROJECT_ROOT}/zookeeper-client/zookeeper-client-c/ssl/gencerts.sh ${WORK_DIR}/ssl/
     cd ${WORK_DIR}/ssl/
     ./gencerts.sh
     cd -

From b92f686e82a16bc079b6e345e942e04e79c26790 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Date: Wed, 16 Oct 2019 15:18:27 +0200
Subject: [PATCH 3/4] ZOOKEEPER-3567: fix license check issue

---
 pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pom.xml b/pom.xml
index a08bb25e1a3..3654247be05 100755
--- a/pom.xml
+++ b/pom.xml
@@ -798,6 +798,7 @@
             <exclude>zookeeper-contrib-fatjar/src/main/resources/mainClasses</exclude>
             <exclude>zookeeper-contrib-zkperl/Changes</exclude>
             <exclude>zookeeper-contrib-zkperl/MANIFEST</exclude>
+            <exclude>zookeeper-contrib-zkpython/src/test/zoo.cfg</exclude>
             <exclude>zookeeper-contrib-loggraph/src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
             <exclude>src/main/resources/webapp/org/apache/zookeeper/graph/resources/*</exclude>
             <exclude>src/main/java/com/nitido/utils/toaster/Toaster.java</exclude>

From d25d61024f0f2ab5b72de42eeccd45b9c30d6239 Mon Sep 17 00:00:00 2001
From: Mate Szalay-Beko <szalay.beko.mate@gmail.com>
Date: Tue, 26 Nov 2019 13:41:11 +0100
Subject: [PATCH 4/4] ZOOKEEPER-3567: fix build issues after top-level ant
 removal

---
 README_packaging.md                 |  6 ++---
 zookeeper-contrib/build-contrib.xml |  2 +-
 zookeeper-contrib/ivysettings.xml   | 41 +++++++++++++++++++++++++++++
 3 files changed, 45 insertions(+), 4 deletions(-)
 create mode 100644 zookeeper-contrib/ivysettings.xml

diff --git a/README_packaging.md b/README_packaging.md
index e2a2d47672a..0f01369553b 100644
--- a/README_packaging.md
+++ b/README_packaging.md
@@ -19,11 +19,11 @@ yum install python-setuptools
 yum install openssl openssl-devel
 ```
 
-On Ubuntu:
+On Ubuntu (in case of 16.4+):
 
 ```
-apt-get install cppunit
-apt-get install python-setuptools
+apt-get install libcppunit-dev
+apt-get install python-setuptools python2.7-dev
 apt-get install openssl libssl-dev
 ```
 
diff --git a/zookeeper-contrib/build-contrib.xml b/zookeeper-contrib/build-contrib.xml
index 681db2d763e..34f3c9b03b3 100644
--- a/zookeeper-contrib/build-contrib.xml
+++ b/zookeeper-contrib/build-contrib.xml
@@ -47,7 +47,7 @@
   <property name="ivy.home" value="${user.home}/.ant" />
   <property name="ivy.lib" value="${build.dir}/lib"/>
   <property name="ivy.test.lib" value="${build.test}/lib"/>
-  <property name="ivysettings.xml" value="${zk.root}/ivysettings.xml"/>
+  <property name="ivysettings.xml" value="${zk.root}/zookeeper-contrib/ivysettings.xml"/>
 
   <!-- to be overridden by sub-projects -->
   <target name="check-contrib"/>
diff --git a/zookeeper-contrib/ivysettings.xml b/zookeeper-contrib/ivysettings.xml
new file mode 100644
index 00000000000..15c98b6ec4e
--- /dev/null
+++ b/zookeeper-contrib/ivysettings.xml
@@ -0,0 +1,41 @@
+<ivysettings>
+
+  <!--
+    Licensed to the Apache Software Foundation (ASF) under one or more
+    contributor license agreements.  See the NOTICE file distributed with
+    this work for additional information regarding copyright ownership.
+    The ASF licenses this file to You under the Apache License, Version 2.0
+    (the "License"); you may not use this file except in compliance with
+    the License.  You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+ -->
+
+  <property name="repo.maven.org"
+            value="https://repo1.maven.org/maven2/" override="false"/>
+  <property name="repo.jboss.org"
+            value="https://repository.jboss.org/nexus/content/groups/public/" override="false"/>
+  <property name="maven2.pattern"
+            value="[organisation]/[module]/[revision]/[module]-[revision]"/>
+  <property name="maven2.pattern.ext" value="${maven2.pattern}.[ext]"/>
+  <include url="${ivy.default.conf.dir}/ivyconf-local.xml"/>
+  <settings defaultResolver="default"/>
+  <resolvers>
+    <ibiblio name="maven2" root="${repo.maven.org}"
+             pattern="${maven2.pattern.ext}" m2compatible="true"/>
+    <ibiblio name="jboss-maven2" root="${repo.jboss.org}"
+             pattern="${maven2.pattern.ext}" m2compatible="true"/>
+
+    <chain name="default" dual="true">
+      <resolver ref="maven2"/>
+      <resolver ref="jboss-maven2"/>
+    </chain>
+
+  </resolvers>
+</ivysettings>