package com.ard.web.controller.sample.media;
|
|
import com.ard.oss.model.CredentialsDTO;
|
import com.ard.oss.service.impl.OssServiceContext;
|
import io.swagger.annotations.Api;
|
import io.swagger.annotations.ApiOperation;
|
import lombok.extern.slf4j.Slf4j;
|
import okhttp3.*;
|
import okio.BufferedSink;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.beans.factory.annotation.Value;
|
import org.springframework.web.bind.annotation.RequestMapping;
|
import org.springframework.web.bind.annotation.RestController;
|
|
import javax.net.ssl.*;
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
import java.io.ByteArrayOutputStream;
|
import java.io.IOException;
|
import java.io.InputStream;
|
import java.security.SecureRandom;
|
import java.security.cert.X509Certificate;
|
import java.util.Enumeration;
|
import java.util.concurrent.TimeUnit;
|
|
/**
|
* MinIO STS代理控制器（HTTP入站 → HTTPS出站）
|
* 1. 机场/Apifox → 代理：HTTP（无鉴权/旧鉴权）
|
* 2. 代理 → MinIO：HTTPS（注入新STS凭证）
|
* 3. 彻底清除客户端鉴权头，避免冲突
|
*/
|
@Api(tags = "机场上传minio")
|
@Slf4j
|
@RestController
|
@RequestMapping("/minioTransfer")
|
public class MinioStsProxyController {
|
|
// ==================== 常量配置 ====================
|
private static final String PROXY_PREFIX = "/minioTransfer";
|
private static final int BUFFER_SIZE = 65536; // 64K缓冲区
|
private static final long MAX_MEMORY_SIZE = 1024 * 1024 * 100; // 100MB
|
private static final String X_AMZ_SECURITY_TOKEN = "X-Amz-Security-Token";
|
private static final String TRANSFER_ENCODING = "Transfer-Encoding";
|
private static final String HOST = "Host";
|
|
// 需要清除的客户端鉴权头（核心：避免和代理侧凭证冲突）
|
private static final String[] AUTH_HEADERS_TO_REMOVE = {
|
"Authorization", "X-Amz-Access-Key-Id", "X-Amz-Secret-Access-Key",
|
"X-Amz-Security-Token", "AccessKey", "SecretKey", "Token", "Authorization-Token"
|
};
|
|
// 配置注入（保留MinIO HTTPS地址，不修改）
|
@Value("${oss.endpoint}")
|
private String minioEndpoint; // 配置为：https://192.168.1.3:9001
|
|
@Autowired
|
private OssServiceContext ossService;
|
|
// OkHttp客户端（HTTPS优化版，解决SSL连接重置）
|
private static OkHttpClient httpClient;
|
|
// 静态初始化：HTTPS SSL兼容配置（适配MinIO自签名证书）
|
static {
|
try {
|
// 1. 信任所有SSL证书（内网MinIO自签名证书专用）
|
TrustManager[] trustAllCerts = new TrustManager[]{
|
new X509TrustManager() {
|
@Override
|
public void checkClientTrusted(X509Certificate[] chain, String authType) {}
|
@Override
|
public void checkServerTrusted(X509Certificate[] chain, String authType) {}
|
@Override
|
public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
|
}
|
};
|
|
// 2. 强制TLS 1.2 + 禁用SSL会话复用（解决版本不匹配/连接重置）
|
SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
|
sslContext.init(null, trustAllCerts, new SecureRandom());
|
SSLSocketFactory sslSocketFactory = new SSLSocketFactoryWrapper(sslContext.getSocketFactory());
|
|
// 3. 构建高兼容性HTTPS客户端
|
httpClient = new OkHttpClient.Builder()
|
.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
|
.hostnameVerifier((hostname, session) -> true) // 禁用主机名校验
|
.connectTimeout(30, TimeUnit.SECONDS)
|
.readTimeout(1800, TimeUnit.SECONDS) // 30分钟读超时（大文件）
|
.writeTimeout(1800, TimeUnit.SECONDS) // 30分钟写超时
|
.connectionPool(new ConnectionPool(30, 10, TimeUnit.MINUTES)) // 扩大连接池
|
.retryOnConnectionFailure(true) // 开启连接重试
|
.pingInterval(10, TimeUnit.SECONDS) // TCP保活（防止连接被重置）
|
.callTimeout(60, TimeUnit.SECONDS)
|
.build();
|
|
log.info("OkHttp客户端初始化完成（HTTPS优化版，适配MinIO）");
|
} catch (Exception e) {
|
log.error("OkHttp初始化失败，降级为默认客户端", e);
|
httpClient = new OkHttpClient();
|
}
|
}
|
|
/**
|
* 核心代理方法：HTTP入站 → HTTPS出站 + 鉴权替换
|
*/
|
@ApiOperation("MinIO STS代理（HTTP→HTTPS中转）")
|
@RequestMapping("/**")
|
public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
|
String method = request.getMethod();
|
String requestUri = request.getRequestURI();
|
String queryString = request.getQueryString();
|
long contentLength = request.getContentLengthLong();
|
|
log.info("STS代理请求开始 | 方法:{} | 入站URI:{} | 参数:{} | 内容长度:{}B",
|
method, requestUri, queryString, contentLength);
|
|
// 1. 构造MinIO目标地址（保留HTTPS，不修改）
|
String targetUrl = buildTargetUrl(requestUri, queryString);
|
if (targetUrl == null) {
|
sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
|
return;
|
}
|
log.info("代理出站地址（HTTPS）：{}", targetUrl);
|
|
// 2. 获取代理侧新STS凭证（核心：替换客户端鉴权）
|
CredentialsDTO credentials = getCredentials();
|
if (credentials == null) {
|
sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效/缺失");
|
return;
|
}
|
|
// 3. 构建请求（清除客户端鉴权 + 注入新凭证 + HTTPS出站）
|
try {
|
Request okRequest = buildRequest(request, method, targetUrl, credentials);
|
forwardResponse(okRequest, response);
|
log.info("STS代理请求成功 | 出站地址:{}", targetUrl);
|
} catch (Exception e) {
|
log.error("STS代理请求执行异常", e);
|
String errorMsg = e.getMessage().contains("Connection reset") ?
|
"MinIO HTTPS连接重置（已优化SSL配置，检查MinIO服务）" : "代理服务异常";
|
sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, errorMsg);
|
}
|
}
|
|
/**
|
* 构造MinIO目标地址（保留HTTPS，完全按配置）
|
*/
|
private String buildTargetUrl(String requestUri, String queryString) {
|
try {
|
// 仅截取代理前缀，保留原始路径，不修改协议/端口
|
String targetPath = requestUri.substring(PROXY_PREFIX.length());
|
StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
|
if (queryString != null && !queryString.isBlank()) {
|
urlBuilder.append("?").append(queryString);
|
}
|
return urlBuilder.toString();
|
} catch (Exception e) {
|
log.error("构造MinIO目标地址失败", e);
|
return null;
|
}
|
}
|
|
/**
|
* 获取代理侧新STS凭证（严格校验完整性）
|
*/
|
private CredentialsDTO getCredentials() {
|
try {
|
CredentialsDTO dto = ossService.getCredentials();
|
// 校验核心字段：AK/SK/Token必须完整
|
if (dto == null || dto.getAccessKeyId() == null || dto.getAccessKeySecret() == null || dto.getSecurityToken() == null) {
|
log.error("STS凭证核心字段缺失（AK/SK/Token不能为空）");
|
return null;
|
}
|
log.info("STS新凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
|
return dto;
|
} catch (Exception e) {
|
log.error("获取STS新凭证异常", e);
|
return null;
|
}
|
}
|
|
/**
|
* 构建请求：清除客户端鉴权头 + 注入代理侧新凭证 + HTTPS出站
|
*/
|
private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
|
Request.Builder builder = new Request.Builder().url(url);
|
|
// ========== 核心步骤1：彻底清除客户端所有鉴权头 ==========
|
Enumeration<String> headerNames = request.getHeaderNames();
|
while (headerNames.hasMoreElements()) {
|
String name = headerNames.nextElement();
|
|
// 跳过Host头（OkHttp自动处理，避免冲突）
|
if (name.equalsIgnoreCase(HOST)) {
|
continue;
|
}
|
|
// 跳过所有鉴权相关头（彻底清除客户端鉴权）
|
boolean isAuthHeader = false;
|
for (String authHeader : AUTH_HEADERS_TO_REMOVE) {
|
if (name.equalsIgnoreCase(authHeader)) {
|
isAuthHeader = true;
|
log.info("清除客户端鉴权头：{} = {}", name, request.getHeader(name));
|
break;
|
}
|
}
|
|
// 透传非鉴权头（如Content-Type、Content-Length等）
|
if (!isAuthHeader) {
|
builder.addHeader(name, request.getHeader(name));
|
}
|
}
|
|
// ========== 核心步骤2：注入代理侧新STS凭证（HTTPS出站鉴权） ==========
|
// 1. STS临时令牌（MinIO STS必须）
|
builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
|
// 2. AK/SK（MinIO HTTPS鉴权需要）
|
builder.addHeader("X-Amz-Access-Key-Id", credentials.getAccessKeyId());
|
builder.addHeader("X-Amz-Secret-Access-Key", credentials.getAccessKeySecret());
|
// 3. 强制HTTPS连接保活（解决SSL连接重置）
|
builder.addHeader("Connection", "keep-alive");
|
builder.addHeader("X-Amz-Date", String.valueOf(System.currentTimeMillis())); // 签名必要头
|
|
// ========== 构建请求体（分大小文件处理） ==========
|
RequestBody body = null;
|
if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
|
InputStream inputStream = request.getInputStream();
|
long contentLength = request.getContentLengthLong();
|
|
// 小文件：预读取到内存（稳定，适配分块上传）
|
if (contentLength > 0 && contentLength <= MAX_MEMORY_SIZE) {
|
log.info("小文件/分块上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
|
byte[] content = readInputStreamToBytes(inputStream);
|
MediaType mediaType = MediaType.parse(request.getContentType() == null ? "application/octet-stream" : request.getContentType());
|
body = RequestBody.create(content, mediaType);
|
}
|
// 大文件：流式上传（省内存，避免OOM）
|
else {
|
log.info("大文件/未知长度上传：使用流式传输（HTTPS出站）");
|
body = new RequestBody() {
|
@Override
|
public MediaType contentType() {
|
return MediaType.parse(request.getContentType() == null ? "application/octet-stream" : request.getContentType());
|
}
|
|
@Override
|
public long contentLength() {
|
return contentLength; // 避免chunked编码，适配MinIO HTTPS
|
}
|
|
@Override
|
public void writeTo(BufferedSink sink) throws IOException {
|
byte[] buffer = new byte[BUFFER_SIZE];
|
int len;
|
long totalWritten = 0;
|
try (InputStream in = inputStream) {
|
while ((len = in.read(buffer)) != -1) {
|
sink.write(buffer, 0, len);
|
totalWritten += len;
|
// 每100MB刷新一次（防止HTTPS缓冲区溢出）
|
if (totalWritten % (1024 * 1024 * 100) == 0) {
|
sink.flush();
|
log.info("HTTPS出站已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
|
}
|
}
|
sink.flush(); // 最终刷新，确保所有数据发送
|
}
|
}
|
};
|
}
|
}
|
|
return builder.method(method, body).build();
|
}
|
|
/**
|
* 读取InputStream到字节数组（小文件专用）
|
*/
|
private byte[] readInputStreamToBytes(InputStream inputStream) throws IOException {
|
try (ByteArrayOutputStream bos = new ByteArrayOutputStream()) {
|
byte[] buffer = new byte[BUFFER_SIZE];
|
int len;
|
while ((len = inputStream.read(buffer)) != -1) {
|
bos.write(buffer, 0, len);
|
}
|
bos.flush();
|
return bos.toByteArray();
|
}
|
}
|
|
/**
|
* 转发MinIO HTTPS响应到客户端（HTTP返回）
|
*/
|
private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
|
try (Response okResponse = httpClient.newCall(request).execute()) {
|
// 1. 基础响应配置（HTTP返回给客户端）
|
response.setStatus(okResponse.code());
|
response.setCharacterEncoding("UTF-8");
|
String contentType = okResponse.header("Content-Type");
|
if (contentType != null) {
|
response.setContentType(contentType); // 透传XML/JSON/文件类型
|
}
|
|
// 2. 透传响应头（排除Transfer-Encoding，避免Tomcat重复编码）
|
Headers headers = okResponse.headers();
|
for (String name : headers.names()) {
|
if (!name.equalsIgnoreCase(TRANSFER_ENCODING)) {
|
response.setHeader(name, headers.get(name));
|
}
|
}
|
|
// 3. 透传响应体（如MinIO返回的UploadId、ETag、合并成功响应等）
|
ResponseBody responseBody = okResponse.body();
|
if (responseBody != null) {
|
try (InputStream in = responseBody.byteStream()) {
|
byte[] buffer = new byte[BUFFER_SIZE];
|
int len;
|
while ((len = in.read(buffer)) != -1) {
|
response.getOutputStream().write(buffer, 0, len);
|
}
|
response.getOutputStream().flush();
|
}
|
}
|
}
|
}
|
|
/**
|
* 统一返回错误响应（HTTP返回给客户端）
|
*/
|
private void sendError(HttpServletResponse response, int code, String msg) {
|
try {
|
response.sendError(code, msg);
|
} catch (IOException e) {
|
log.error("发送错误响应失败", e);
|
}
|
}
|
|
/**
|
* SSLSocketFactory包装类（解决TLS 1.2强制生效问题）
|
*/
|
static class SSLSocketFactoryWrapper extends SSLSocketFactory {
|
private final SSLSocketFactory delegate;
|
|
public SSLSocketFactoryWrapper(SSLSocketFactory delegate) {
|
this.delegate = delegate;
|
}
|
|
@Override
|
public String[] getDefaultCipherSuites() {
|
return delegate.getDefaultCipherSuites();
|
}
|
|
@Override
|
public String[] getSupportedCipherSuites() {
|
return delegate.getSupportedCipherSuites();
|
}
|
|
@Override
|
public java.net.Socket createSocket(java.net.Socket socket, String host, int port, boolean autoClose) throws IOException {
|
SSLSocket sslSocket = (SSLSocket) delegate.createSocket(socket, host, port, autoClose);
|
// 强制启用TLS 1.2，禁用低版本
|
sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
|
return sslSocket;
|
}
|
|
@Override
|
public java.net.Socket createSocket(String host, int port) throws IOException {
|
SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
|
sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
|
return sslSocket;
|
}
|
|
@Override
|
public java.net.Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws IOException {
|
SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port, localHost, localPort);
|
sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
|
return sslSocket;
|
}
|
|
@Override
|
public java.net.Socket createSocket(java.net.InetAddress host, int port) throws IOException {
|
SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
|
sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
|
return sslSocket;
|
}
|
|
@Override
|
public java.net.Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws IOException {
|
SSLSocket sslSocket = (SSLSocket) delegate.createSocket(address, port, localAddress, localPort);
|
sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
|
return sslSocket;
|
}
|
}
|
}
|
