Revert "Remove deprecated SecurityConfigurator and Builder.secure() A…

…PIs (#1438)" (#1463)

Motivation:
Folks need more time to digest the deprecation and migrate to the new
APIs.

Modifications:
- This reverts commit d032436.

docs/modules/ROOT/pages/performance.adoc

@@ -584,10 +584,11 @@ link:https://wiki.mozilla.org/Security/Server_Side_TLS[Mozilla Server Side TLS])
 
 [source, java]
 ----
-// You can force the provider to OPENSSL as demonstrated below, or don't specify the provider and OPENSSL will be used
-// if available on the classpath (currently runtime dependency of ServiceTalk).
+
+// add the netty dependency to your build, eg: "io.netty:netty-tcnative-boringssl-static:2.0.25.Final"
+
 BlockingHttpClient client = HttpClients.forSingleAddress("servicetalk.io", 443)
-        .sslConfig(new ServerSslConfigBuilder(..).provider(OPENSSL).build())
+        .secure().provider(SecurityConfigurator.SslProvider.OPENSSL).commit()
         .buildBlocking();
 HttpResponse resp = client.request(client.get("/"));
 ----

servicetalk-grpc-api/src/main/java/io/servicetalk/grpc/api/GrpcClientBuilder.java

@@ -87,6 +87,10 @@ public abstract GrpcClientBuilder<U, R> appendConnectionFactoryFilter(
     public abstract GrpcClientBuilder<U, R> appendConnectionFilter(Predicate<StreamingHttpRequest> predicate,
                                                                    StreamingHttpConnectionFilterFactory factory);
 
+    @Deprecated
+    @Override
+    public abstract GrpcClientSecurityConfigurator<U, R> secure();
+
     @Override
     public abstract GrpcClientBuilder<U, R> sslConfig(ClientSslConfig sslConfig);
 

servicetalk-grpc-api/src/main/java/io/servicetalk/grpc/api/GrpcClientSecurityConfigurator.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright © 2019 Apple Inc. and the ServiceTalk project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.servicetalk.grpc.api;
+
+import io.servicetalk.transport.api.ClientSecurityConfigurator;
+import io.servicetalk.transport.api.ClientSslConfig;
+
+import java.io.InputStream;
+import java.util.function.Supplier;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManagerFactory;
+
+/**
+ * A {@link ClientSecurityConfigurator} for {@link SingleAddressGrpcClientBuilder}.
+ * @deprecated Use {@link GrpcClientBuilder#sslConfig(ClientSslConfig)}.
+ * @param <U> the type of address before resolution (unresolved address)
+ * @param <R> the type of address after resolution (resolved address)
+ */
+@Deprecated
+public interface GrpcClientSecurityConfigurator<U, R> extends ClientSecurityConfigurator {
+    /**
+     * Commit configuring client security.
+     *
+     * @return Original {@link GrpcClientBuilder} that initiated the security configuration process.
+     */
+    GrpcClientBuilder<U, R> commit();
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> trustManager(Supplier<InputStream> trustCertChainSupplier);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> trustManager(TrustManagerFactory trustManagerFactory);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> protocols(String... protocols);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> ciphers(Iterable<String> ciphers);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> sessionCacheSize(long sessionCacheSize);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> sessionTimeout(long sessionTimeout);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> provider(SslProvider provider);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> hostnameVerificationAlgorithm(
+            String hostNameVerificationAlgorithm);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> hostnameVerification(String hostNameVerificationAlgorithm,
+                                                              String hostNameVerificationHost);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> hostnameVerification(String hostNameVerificationAlgorithm,
+                                                              String hostNameVerificationHost,
+                                                              int hostNameVerificationPort);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> hostnameVerification(String hostNameVerificationHost);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> hostnameVerification(String hostNameVerificationHost,
+                                                              int hostNameVerificationPort);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> sniHostname(String sniHostname);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> disableHostnameVerification();
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> keyManager(KeyManagerFactory keyManagerFactory);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> keyManager(Supplier<InputStream> keyCertChainSupplier,
+                                                    Supplier<InputStream> keySupplier);
+
+    @Override
+    GrpcClientSecurityConfigurator<U, R> keyManager(Supplier<InputStream> keyCertChainSupplier,
+                                                    Supplier<InputStream> keySupplier, String keyPassword);
+}

servicetalk-grpc-api/src/main/java/io/servicetalk/grpc/api/GrpcServerBuilder.java

@@ -78,6 +78,16 @@ public GrpcServerBuilder backlog(int backlog) {
         return this;
     }
 
+    /**
+     * Initiate security configuration for this server. Calling any {@code commit} method on the returned
+     * {@link GrpcServerSecurityConfigurator} will commit the configuration.
+     * @deprecated Use {@link #sslConfig(ServerSslConfig)}.
+     * @return {@link GrpcServerSecurityConfigurator} to configure security for this server. It is
+     * mandatory to call any one of the {@code commit} methods after all configuration is done.
+     */
+    @Deprecated
+    public abstract GrpcServerSecurityConfigurator secure();
+
     /**
      * Set the SSL/TLS configuration.
      * @param config The configuration to use.

servicetalk-grpc-api/src/main/java/io/servicetalk/grpc/api/GrpcServerSecurityConfigurator.java

@@ -0,0 +1,99 @@
+/*
+ * Copyright © 2019 Apple Inc. and the ServiceTalk project authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.servicetalk.grpc.api;
+
+import io.servicetalk.transport.api.ServerSecurityConfigurator;
+import io.servicetalk.transport.api.ServerSslConfig;
+
+import java.io.InputStream;
+import java.util.function.Supplier;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManagerFactory;
+
+/**
+ * A {@link ServerSecurityConfigurator} for {@link GrpcServerBuilder}.
+ * @deprecated Use {@link GrpcServerBuilder#sslConfig(ServerSslConfig)}.
+ */
+@Deprecated
+public interface GrpcServerSecurityConfigurator extends ServerSecurityConfigurator {
+    @Override
+    GrpcServerSecurityConfigurator trustManager(Supplier<InputStream> trustCertChainSupplier);
+
+    @Override
+    GrpcServerSecurityConfigurator trustManager(TrustManagerFactory trustManagerFactory);
+
+    @Override
+    GrpcServerSecurityConfigurator protocols(String... protocols);
+
+    @Override
+    GrpcServerSecurityConfigurator ciphers(Iterable<String> ciphers);
+
+    @Override
+    GrpcServerSecurityConfigurator sessionCacheSize(long sessionCacheSize);
+
+    @Override
+    GrpcServerSecurityConfigurator sessionTimeout(long sessionTimeout);
+
+    @Override
+    GrpcServerSecurityConfigurator provider(SslProvider provider);
+
+    @Override
+    GrpcServerSecurityConfigurator clientAuth(ClientAuth clientAuth);
+
+    /**
+     * Commit configuring server security.
+     *
+     * @param keyManagerFactory an {@link KeyManagerFactory}.
+     * @return Original {@link GrpcServerBuilder} that initiated the security configuration process.
+     */
+    GrpcServerBuilder commit(KeyManagerFactory keyManagerFactory);
+
+    /**
+     * Commit configuring server security.
+     *
+     * @param keyCertChainSupplier an {@link Supplier} that will provide an input stream for a {@code X.509} certificate
+     * chain in {@code PEM} format.
+     * <p>
+     * The responsibility to call {@link InputStream#close()} is transferred to callers of the {@link Supplier}.
+     * If this is not the desired behavior then wrap the {@link InputStream} and override {@link InputStream#close()}.
+     * @param keySupplier an {@link Supplier} that will provide an input stream for a {@code KCS#8} private key in
+     * {@code PEM} format.
+     * <p>
+     * The responsibility to call {@link InputStream#close()} is transferred to callers of the {@link Supplier}.
+     * If this is not the desired behavior then wrap the {@link InputStream} and override {@link InputStream#close()}.
+     * @return Original {@link GrpcServerBuilder} that initiated the security configuration process.
+     */
+    GrpcServerBuilder commit(Supplier<InputStream> keyCertChainSupplier, Supplier<InputStream> keySupplier);
+
+    /**
+     * Commit configuring server security.
+     *
+     * @param keyCertChainSupplier an {@link Supplier} that will provide an input stream for a {@code X.509} certificate
+     * chain in {@code PEM} format.
+     * <p>
+     * The responsibility to call {@link InputStream#close()} is transferred to callers of the {@link Supplier}.
+     * If this is not the desired behavior then wrap the {@link InputStream} and override {@link InputStream#close()}.
+     * @param keySupplier an {@link Supplier} that will provide an input stream for a {@code KCS#8} private key in
+     * {@code PEM} format.
+     * <p>
+     * The responsibility to call {@link InputStream#close()} is transferred to callers of the {@link Supplier}.
+     * If this is not the desired behavior then wrap the {@link InputStream} and override {@link InputStream#close()}.
+     * @param keyPassword the password of the {@code keyFile}.
+     * @return Original {@link GrpcServerBuilder} that initiated the security configuration process.
+     */
+    GrpcServerBuilder commit(Supplier<InputStream> keyCertChainSupplier, Supplier<InputStream> keySupplier,
+                             String keyPassword);
+}

servicetalk-grpc-api/src/main/java/io/servicetalk/grpc/api/SingleAddressGrpcClientBuilder.java

@@ -95,6 +95,18 @@ SingleAddressGrpcClientBuilder<U, R, SDE> appendConnectionFactoryFilter(
     SingleAddressGrpcClientBuilder<U, R, SDE> appendConnectionFilter(Predicate<StreamingHttpRequest> predicate,
                                                                      StreamingHttpConnectionFilterFactory factory);
 
+    /**
+     * Initiate security configuration for this client. Calling
+     * {@link GrpcClientSecurityConfigurator#commit()} on the returned {@link GrpcClientSecurityConfigurator} will
+     * commit the configuration.
+     * @deprecated Use {@link #sslConfig(ClientSslConfig)}.
+     * @return {@link GrpcClientSecurityConfigurator} to configure security for this client. It is
+     * mandatory to call {@link GrpcClientSecurityConfigurator#commit() commit} after all configuration is
+     * done.
+     */
+    @Deprecated
+    GrpcClientSecurityConfigurator<U, R> secure();
+
     /**
      * Set the SSL/TLS configuration.
      * @param sslConfig The configuration to use.

servicetalk-grpc-netty/src/main/java/io/servicetalk/grpc/netty/DefaultGrpcClientBuilder.java

@@ -22,11 +22,13 @@
 import io.servicetalk.client.api.ServiceDiscovererEvent;
 import io.servicetalk.grpc.api.GrpcClientBuilder;
 import io.servicetalk.grpc.api.GrpcClientCallFactory;
+import io.servicetalk.grpc.api.GrpcClientSecurityConfigurator;
 import io.servicetalk.grpc.api.GrpcExecutionStrategy;
 import io.servicetalk.http.api.FilterableStreamingHttpConnection;
 import io.servicetalk.http.api.HttpLoadBalancerFactory;
 import io.servicetalk.http.api.HttpProtocolConfig;
 import io.servicetalk.http.api.SingleAddressHttpClientBuilder;
+import io.servicetalk.http.api.SingleAddressHttpClientSecurityConfigurator;
 import io.servicetalk.http.api.StreamingHttpClientFilterFactory;
 import io.servicetalk.http.api.StreamingHttpConnectionFilterFactory;
 import io.servicetalk.http.api.StreamingHttpRequest;
@@ -114,6 +116,13 @@ public GrpcClientBuilder<U, R> appendConnectionFilter(
         return this;
     }
 
+    @Deprecated
+    @Override
+    public GrpcClientSecurityConfigurator<U, R> secure() {
+        SingleAddressHttpClientSecurityConfigurator<U, R> httpConfigurator = httpClientBuilder.secure();
+        return new DefaultGrpcClientSecurityConfigurator<>(httpConfigurator, this);
+    }
+
     @Override
     public GrpcClientBuilder<U, R> sslConfig(final ClientSslConfig sslConfig) {
         httpClientBuilder.sslConfig(sslConfig);