From 28ab28fbca6a4253bfc1f0b213576bf43e42c407 Mon Sep 17 00:00:00 2001
From: Xiajijian <1176061145@qq.com>
Date: Mon, 09 Mar 2026 11:23:23 +0800
Subject: [PATCH] 1. 增加根据点云ID查询航线名称接口。 2. 优化查询精细化巡检分组细节，增加查询条件。
---
ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java | 228 ++++++++++++++++++++++++++++++++++++++------------------
1 files changed, 155 insertions(+), 73 deletions(-)
diff --git a/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java b/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
index 6fa3ac7..c0bc555 100644
--- a/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
+++ b/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
@@ -12,19 +12,22 @@
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
+import javax.net.ssl.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
+import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
import java.util.Enumeration;
import java.util.concurrent.TimeUnit;
/**
- * MinIO STS代理控制器（终极版）
- * 1. 彻底清除客户端鉴权头 + 替换为代理侧STS凭证
- * 2. 强制HTTP通信（绕过SSL连接重置问题）
- * 3. 适配分块上传全流程
+ * MinIO STS代理控制器（HTTP入站 → HTTPS出站）
+ * 1. 机场/Apifox → 代理：HTTP（无鉴权/旧鉴权）
+ * 2. 代理 → MinIO：HTTPS（注入新STS凭证）
+ * 3. 彻底清除客户端鉴权头，避免冲突
*/
@Api(tags = "机场上传minio")
@Slf4j
@@ -40,43 +43,66 @@
private static final String TRANSFER_ENCODING = "Transfer-Encoding";
private static final String HOST = "Host";
- // 需清除的客户端鉴权头（核心：避免和代理侧凭证冲突）
+ // 需要清除的客户端鉴权头（核心：避免和代理侧凭证冲突）
private static final String[] AUTH_HEADERS_TO_REMOVE = {
"Authorization", "X-Amz-Access-Key-Id", "X-Amz-Secret-Access-Key",
- "X-Amz-Security-Token", "AccessKey", "SecretKey", "Token"
+ "X-Amz-Security-Token", "AccessKey", "SecretKey", "Token", "Authorization-Token"
};
- // 配置注入
+ // 配置注入（保留MinIO HTTPS地址，不修改）
@Value("${oss.endpoint}")
- private String minioEndpoint;
- private Integer connectTimeout = 30;
- private Integer readWriteTimeout = 1800;
+ private String minioEndpoint; // 配置为：https://192.168.1.3:9001
@Autowired
private OssServiceContext ossService;
- // OkHttp客户端（禁用SSL，强制HTTP，最大化兼容性）
+ // OkHttp客户端（HTTPS优化版，解决SSL连接重置）
private static OkHttpClient httpClient;
+ // 静态初始化：HTTPS SSL兼容配置（适配MinIO自签名证书）
static {
- // 构建纯HTTP客户端（彻底绕过SSL问题）
- httpClient = new OkHttpClient.Builder()
- .connectTimeout(30, TimeUnit.SECONDS)
- .readTimeout(1800, TimeUnit.SECONDS) // 30分钟超时
- .writeTimeout(1800, TimeUnit.SECONDS)
- .connectionPool(new ConnectionPool(30, 10, TimeUnit.MINUTES))
- .retryOnConnectionFailure(true) // 开启重试
- .pingInterval(10, TimeUnit.SECONDS) // TCP保活
- .callTimeout(60, TimeUnit.SECONDS)
- .build();
+ try {
+ // 1. 信任所有SSL证书（内网MinIO自签名证书专用）
+ TrustManager[] trustAllCerts = new TrustManager[]{
+ new X509TrustManager() {
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String authType) {}
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String authType) {}
+ @Override
+ public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
+ }
+ };
- log.info("OkHttp客户端初始化完成（纯HTTP模式，禁用SSL）");
+ // 2. 强制TLS 1.2 + 禁用SSL会话复用（解决版本不匹配/连接重置）
+ SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
+ sslContext.init(null, trustAllCerts, new SecureRandom());
+ SSLSocketFactory sslSocketFactory = new SSLSocketFactoryWrapper(sslContext.getSocketFactory());
+
+ // 3. 构建高兼容性HTTPS客户端
+ httpClient = new OkHttpClient.Builder()
+ .sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
+ .hostnameVerifier((hostname, session) -> true) // 禁用主机名校验
+ .connectTimeout(30, TimeUnit.SECONDS)
+ .readTimeout(1800, TimeUnit.SECONDS) // 30分钟读超时（大文件）
+ .writeTimeout(1800, TimeUnit.SECONDS) // 30分钟写超时
+ .connectionPool(new ConnectionPool(30, 10, TimeUnit.MINUTES)) // 扩大连接池
+ .retryOnConnectionFailure(true) // 开启连接重试
+ .pingInterval(10, TimeUnit.SECONDS) // TCP保活（防止连接被重置）
+ .callTimeout(60, TimeUnit.SECONDS)
+ .build();
+
+ log.info("OkHttp客户端初始化完成（HTTPS优化版，适配MinIO）");
+ } catch (Exception e) {
+ log.error("OkHttp初始化失败，降级为默认客户端", e);
+ httpClient = new OkHttpClient();
+ }
}
/**
- * 核心代理方法：清除客户端鉴权 + 替换为代理侧STS凭证
+ * 核心代理方法：HTTP入站 → HTTPS出站 + 鉴权替换
*/
- @ApiOperation("MinIO STS代理（清除客户端鉴权+强制HTTP）")
+ @ApiOperation("MinIO STS代理（HTTP→HTTPS中转）")
@RequestMapping("/**")
public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
String method = request.getMethod();
@@ -84,134 +110,132 @@
String queryString = request.getQueryString();
long contentLength = request.getContentLengthLong();
- log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{} | 内容长度:{}B",
+ log.info("STS代理请求开始 | 方法:{} | 入站URI:{} | 参数:{} | 内容长度:{}B",
method, requestUri, queryString, contentLength);
- // 1. 构造目标地址（强制转换为HTTP，无论配置的是HTTPS）
+ // 1. 构造MinIO目标地址（保留HTTPS，不修改）
String targetUrl = buildTargetUrl(requestUri, queryString);
if (targetUrl == null) {
sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
return;
}
+ log.info("代理出站地址（HTTPS）：{}", targetUrl);
- // 2. 获取代理侧STS凭证（核心：替换客户端鉴权）
+ // 2. 获取代理侧新STS凭证（核心：替换客户端鉴权）
CredentialsDTO credentials = getCredentials();
if (credentials == null) {
- sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效");
+ sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效/缺失");
return;
}
- // 3. 构建请求（清除客户端鉴权 + 注入代理侧凭证）
+ // 3. 构建请求（清除客户端鉴权 + 注入新凭证 + HTTPS出站）
try {
Request okRequest = buildRequest(request, method, targetUrl, credentials);
forwardResponse(okRequest, response);
- log.info("STS代理请求成功 | 目标地址:{}", targetUrl);
+ log.info("STS代理请求成功 | 出站地址:{}", targetUrl);
} catch (Exception e) {
log.error("STS代理请求执行异常", e);
String errorMsg = e.getMessage().contains("Connection reset") ?
- "MinIO连接重置（已强制HTTP，需检查MinIO服务是否启动）" : "代理服务异常";
+ "MinIO HTTPS连接重置（已优化SSL配置，检查MinIO服务）" : "代理服务异常";
sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, errorMsg);
}
}
/**
- * 构造目标地址：强制转换为HTTP（核心解决SSL问题）
+ * 构造MinIO目标地址（保留HTTPS，完全按配置）
*/
private String buildTargetUrl(String requestUri, String queryString) {
try {
+ // 仅截取代理前缀，保留原始路径，不修改协议/端口
String targetPath = requestUri.substring(PROXY_PREFIX.length());
- // 强制将HTTPS转为HTTP（无论配置的endpoint是啥）
- String httpEndpoint = minioEndpoint.replace("https://", "http://");
- // 修正端口：MinIO HTTPS默认9001 → HTTP默认9000
- if (httpEndpoint.contains(":9001")) {
- httpEndpoint = httpEndpoint.replace(":9001", ":9000");
- }
-
- StringBuilder urlBuilder = new StringBuilder(httpEndpoint).append(targetPath);
+ StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
if (queryString != null && !queryString.isBlank()) {
urlBuilder.append("?").append(queryString);
}
- String targetUrl = urlBuilder.toString();
- log.info("构造目标地址（强制HTTP）：{}", targetUrl);
- return targetUrl;
+ return urlBuilder.toString();
} catch (Exception e) {
- log.error("构造目标地址失败", e);
+ log.error("构造MinIO目标地址失败", e);
return null;
}
}
/**
- * 获取代理侧STS凭证（确保完整性）
+ * 获取代理侧新STS凭证（严格校验完整性）
*/
private CredentialsDTO getCredentials() {
try {
CredentialsDTO dto = ossService.getCredentials();
+ // 校验核心字段：AK/SK/Token必须完整
if (dto == null || dto.getAccessKeyId() == null || dto.getAccessKeySecret() == null || dto.getSecurityToken() == null) {
- log.error("STS凭证核心字段缺失（AK/SK/Token）");
+ log.error("STS凭证核心字段缺失（AK/SK/Token不能为空）");
return null;
}
- log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
+ log.info("STS新凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
return dto;
} catch (Exception e) {
- log.error("获取STS凭证异常", e);
+ log.error("获取STS新凭证异常", e);
return null;
}
}
/**
- * 构建请求：彻底清除客户端鉴权头 + 注入代理侧STS凭证
+ * 构建请求：清除客户端鉴权头 + 注入代理侧新凭证 + HTTPS出站
*/
private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
Request.Builder builder = new Request.Builder().url(url);
- // ========== 核心步骤1：清除所有客户端鉴权头 ==========
+ // ========== 核心步骤1：彻底清除客户端所有鉴权头 ==========
Enumeration<String> headerNames = request.getHeaderNames();
while (headerNames.hasMoreElements()) {
String name = headerNames.nextElement();
- // 跳过Host头（OkHttp自动处理）
+
+ // 跳过Host头（OkHttp自动处理，避免冲突）
if (name.equalsIgnoreCase(HOST)) {
continue;
}
- // 跳过所有鉴权相关头（避免冲突）
+
+ // 跳过所有鉴权相关头（彻底清除客户端鉴权）
boolean isAuthHeader = false;
for (String authHeader : AUTH_HEADERS_TO_REMOVE) {
if (name.equalsIgnoreCase(authHeader)) {
isAuthHeader = true;
- log.info("清除客户端鉴权头：{}", name);
+ log.info("清除客户端鉴权头：{} = {}", name, request.getHeader(name));
break;
}
}
+
+ // 透传非鉴权头（如Content-Type、Content-Length等）
if (!isAuthHeader) {
builder.addHeader(name, request.getHeader(name));
}
}
- // ========== 核心步骤2：注入代理侧STS凭证 ==========
- // 1. 添加STS临时令牌（MinIO STS必须）
+ // ========== 核心步骤2：注入代理侧新STS凭证（HTTPS出站鉴权） ==========
+ // 1. STS临时令牌（MinIO STS必须）
builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
- // 2. 添加AK/SK（MinIO签名需要，透传给MinIO）
+ // 2. AK/SK（MinIO HTTPS鉴权需要）
builder.addHeader("X-Amz-Access-Key-Id", credentials.getAccessKeyId());
builder.addHeader("X-Amz-Secret-Access-Key", credentials.getAccessKeySecret());
- // 3. 强制HTTP/1.1（避免协议兼容问题）
+ // 3. 强制HTTPS连接保活（解决SSL连接重置）
builder.addHeader("Connection", "keep-alive");
- builder.addHeader("Content-Type", request.getContentType() == null ? "application/octet-stream" : request.getContentType());
+ builder.addHeader("X-Amz-Date", String.valueOf(System.currentTimeMillis())); // 签名必要头
- // ========== 构建请求体（分大小文件） ==========
+ // ========== 构建请求体（分大小文件处理） ==========
RequestBody body = null;
if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
InputStream inputStream = request.getInputStream();
long contentLength = request.getContentLengthLong();
- // 小文件：预读取到内存
+ // 小文件：预读取到内存（稳定，适配分块上传）
if (contentLength > 0 && contentLength <= MAX_MEMORY_SIZE) {
- log.info("小文件上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
+ log.info("小文件/分块上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
byte[] content = readInputStreamToBytes(inputStream);
MediaType mediaType = MediaType.parse(request.getContentType() == null ? "application/octet-stream" : request.getContentType());
body = RequestBody.create(content, mediaType);
}
- // 大文件：流式上传
+ // 大文件：流式上传（省内存，避免OOM）
else {
- log.info("大文件/未知长度上传：使用流式传输");
+ log.info("大文件/未知长度上传：使用流式传输（HTTPS出站）");
body = new RequestBody() {
@Override
public MediaType contentType() {
@@ -220,7 +244,7 @@
@Override
public long contentLength() {
- return contentLength;
+ return contentLength; // 避免chunked编码，适配MinIO HTTPS
}
@Override
@@ -232,12 +256,13 @@
while ((len = in.read(buffer)) != -1) {
sink.write(buffer, 0, len);
totalWritten += len;
+ // 每100MB刷新一次（防止HTTPS缓冲区溢出）
if (totalWritten % (1024 * 1024 * 100) == 0) {
sink.flush();
- log.info("已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
+ log.info("HTTPS出站已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
}
}
- sink.flush();
+ sink.flush(); // 最终刷新，确保所有数据发送
}
}
};
@@ -248,7 +273,7 @@
}
/**
- * 读取InputStream到字节数组
+ * 读取InputStream到字节数组（小文件专用）
*/
private byte[] readInputStreamToBytes(InputStream inputStream) throws IOException {
try (ByteArrayOutputStream bos = new ByteArrayOutputStream()) {
@@ -263,19 +288,19 @@
}
/**
- * 转发MinIO响应到客户端
+ * 转发MinIO HTTPS响应到客户端（HTTP返回）
*/
private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
try (Response okResponse = httpClient.newCall(request).execute()) {
- // 配置响应头
+ // 1. 基础响应配置（HTTP返回给客户端）
response.setStatus(okResponse.code());
response.setCharacterEncoding("UTF-8");
String contentType = okResponse.header("Content-Type");
if (contentType != null) {
- response.setContentType(contentType);
+ response.setContentType(contentType); // 透传XML/JSON/文件类型
}
- // 透传响应头（排除Transfer-Encoding）
+ // 2. 透传响应头（排除Transfer-Encoding，避免Tomcat重复编码）
Headers headers = okResponse.headers();
for (String name : headers.names()) {
if (!name.equalsIgnoreCase(TRANSFER_ENCODING)) {
@@ -283,7 +308,7 @@
}
}
- // 透传响应体
+ // 3. 透传响应体（如MinIO返回的UploadId、ETag、合并成功响应等）
ResponseBody responseBody = okResponse.body();
if (responseBody != null) {
try (InputStream in = responseBody.byteStream()) {
@@ -299,7 +324,7 @@
}
/**
- * 统一返回错误响应
+ * 统一返回错误响应（HTTP返回给客户端）
*/
private void sendError(HttpServletResponse response, int code, String msg) {
try {
@@ -308,4 +333,61 @@
log.error("发送错误响应失败", e);
}
}
+
+ /**
+ * SSLSocketFactory包装类（解决TLS 1.2强制生效问题）
+ */
+ static class SSLSocketFactoryWrapper extends SSLSocketFactory {
+ private final SSLSocketFactory delegate;
+
+ public SSLSocketFactoryWrapper(SSLSocketFactory delegate) {
+ this.delegate = delegate;
+ }
+
+ @Override
+ public String[] getDefaultCipherSuites() {
+ return delegate.getDefaultCipherSuites();
+ }
+
+ @Override
+ public String[] getSupportedCipherSuites() {
+ return delegate.getSupportedCipherSuites();
+ }
+
+ @Override
+ public java.net.Socket createSocket(java.net.Socket socket, String host, int port, boolean autoClose) throws IOException {
+ SSLSocket sslSocket = (SSLSocket) delegate.createSocket(socket, host, port, autoClose);
+ // 强制启用TLS 1.2，禁用低版本
+ sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
+ return sslSocket;
+ }
+
+ @Override
+ public java.net.Socket createSocket(String host, int port) throws IOException {
+ SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
+ sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
+ return sslSocket;
+ }
+
+ @Override
+ public java.net.Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws IOException {
+ SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port, localHost, localPort);
+ sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
+ return sslSocket;
+ }
+
+ @Override
+ public java.net.Socket createSocket(java.net.InetAddress host, int port) throws IOException {
+ SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
+ sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
+ return sslSocket;
+ }
+
+ @Override
+ public java.net.Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws IOException {
+ SSLSocket sslSocket = (SSLSocket) delegate.createSocket(address, port, localAddress, localPort);
+ sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
+ return sslSocket;
+ }
+ }
}
\ No newline at end of file
--
Gitblit v1.9.3