From a12665923c5ec933e2c92ea74135680cc8b3af4a Mon Sep 17 00:00:00 2001
From: zhaowenyu <35589726@qq.com>
Date: Wed, 11 Feb 2026 15:21:28 +0800
Subject: [PATCH] 2026-02-04 优化minio中转接口
---
ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java | 233 ++++++++++++++++++++++++++++++----------------------------
1 files changed, 121 insertions(+), 112 deletions(-)
diff --git a/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java b/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
index f074e65..ca79c62 100644
--- a/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
+++ b/ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java
@@ -19,151 +19,165 @@
import java.io.IOException;
import java.io.InputStream;
import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
import java.util.Enumeration;
import java.util.concurrent.TimeUnit;
+/**
+ * MinIO STS代理控制器（适配分块上传全流程：初始化/传块/合并）
+ * 解决SSL连接重置、鉴权透传、分块合并XML透传问题
+ */
@Api(tags = "机场上传minio")
@Slf4j
@RestController
@RequestMapping("/minioTransfer")
public class MinioStsProxyController {
- // ==================== 常量配置（适配大文件） ====================
+ // ==================== 常量配置 ====================
private static final String PROXY_PREFIX = "/minioTransfer";
- private static final int BUFFER_SIZE = 65536; // 64K缓冲区，提升大文件传输效率
- private static final long MAX_MEMORY_SIZE = 1024 * 1024 * 100; // 100MB，超过则用流式
+ private static final int BUFFER_SIZE = 65536; // 64K缓冲区
+ private static final long MAX_MEMORY_SIZE = 1024 * 1024 * 100; // 100MB（小文件阈值）
private static final String X_AMZ_SECURITY_TOKEN = "X-Amz-Security-Token";
private static final String TRANSFER_ENCODING = "Transfer-Encoding";
- private static final String CONTENT_LENGTH = "Content-Length";
private static final String HOST = "Host";
- // 配置文件注入（大幅提升超时时间）
+ // 配置注入（支持yml配置，避免硬编码）
@Value("${oss.endpoint}")
private String minioEndpoint;
-
- private static final Integer connectTimeout=30;
- private static final Integer readWriteTimeout=1800;
+ private static final Integer connectTimeout = 30;
+ private static final Integer readWriteTimeout = 1800;
@Autowired
private OssServiceContext ossService;
- // OkHttp 单例客户端（全局复用）
+ // OkHttp客户端（全局单例，优化SSL/TCP）
private static OkHttpClient httpClient;
- // 静态初始化，强制TLS 1.2，修复SSL兼容问题
+ // 静态初始化：SSL/TCP优化（适配MinIO内网环境）
static {
- createOkHttpClient();
- }
-
- /**
- * 重构OkHttp客户端：强制TLS 1.2 + 超长超时 + 连接保活
- */
- private static void createOkHttpClient() {
try {
- // 1. 强制使用TLS 1.2，解决SSL版本不兼容导致的连接重置
- SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
+ // 1. 全局信任所有SSL证书（内网专用，生产需替换合法证书）
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
@Override
- public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {}
+ public void checkClientTrusted(X509Certificate[] chain, String authType) {}
@Override
- public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {}
+ public void checkServerTrusted(X509Certificate[] chain, String authType) {}
@Override
- public java.security.cert.X509Certificate[] getAcceptedIssuers() {
- return new java.security.cert.X509Certificate[0];
- }
+ public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
}
};
+
+ // 2. 强制TLS 1.2（解决MinIO SSL版本兼容问题）
+ SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, trustAllCerts, new SecureRandom());
- SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
- // 2. 配置连接工厂，强制TLS 1.2
- ConnectionSpec connectionSpec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
- .tlsVersions(TlsVersion.TLS_1_2)
- .build();
-
- // 3. 构建客户端，增加连接保活和重试
+ // 3. 构建高兼容性OkHttp客户端
httpClient = new OkHttpClient.Builder()
- .sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
- .hostnameVerifier((hostname, session) -> true)
- .connectionSpecs(java.util.Collections.singletonList(connectionSpec)) // 强制TLS 1.2
- .connectTimeout(connectTimeout, TimeUnit.SECONDS)
- .readTimeout(readWriteTimeout, TimeUnit.SECONDS)
- .writeTimeout(readWriteTimeout, TimeUnit.SECONDS)
- .connectionPool(new ConnectionPool(20, 10, TimeUnit.MINUTES)) // 更大的连接池
- .retryOnConnectionFailure(true) // 开启连接失败重试
- .pingInterval(30, TimeUnit.SECONDS) // TCP保活，防止连接被断开
+ .sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0])
+ .hostnameVerifier((hostname, session) -> true) // 禁用主机名校验
+ .connectTimeout(30, TimeUnit.SECONDS)
+ .readTimeout(1800, TimeUnit.SECONDS) // 30分钟读超时（适配大文件）
+ .writeTimeout(1800, TimeUnit.SECONDS) // 30分钟写超时
+ .connectionPool(new ConnectionPool(30, 10, TimeUnit.MINUTES)) // 扩大连接池
+ .retryOnConnectionFailure(true) // 开启连接重试
+ .pingInterval(10, TimeUnit.SECONDS) // TCP保活（防止连接被重置）
+ .callTimeout(60, TimeUnit.SECONDS)
.build();
+ log.info("OkHttp客户端初始化完成（适配MinIO分块上传）");
} catch (Exception e) {
- log.error("OkHttp初始化失败，使用默认客户端", e);
+ log.error("OkHttp初始化失败，降级为默认客户端", e);
httpClient = new OkHttpClient();
}
}
- @ApiOperation("MinIO STS临时凭证通用代理")
+ /**
+ * 核心代理方法：适配MinIO分块上传全流程（POST初始化/PUT传块/POST合并）
+ */
+ @ApiOperation("MinIO STS临时凭证通用代理（支持分块上传）")
@RequestMapping("/**")
public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
String method = request.getMethod();
String requestUri = request.getRequestURI();
String queryString = request.getQueryString();
- log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{} | 内容长度:{}",
- method, requestUri, queryString, request.getContentLengthLong());
+ long contentLength = request.getContentLengthLong();
- // 构造目标地址
+ // 日志增强：区分分块上传阶段
+ String uploadStage = getUploadStage(queryString);
+ log.info("STS代理请求开始 | 阶段:{} | 方法:{} | URI:{} | 参数:{} | 内容长度:{}B",
+ uploadStage, method, requestUri, queryString, contentLength);
+
+ // 1. 构造MinIO目标地址
String targetUrl = buildTargetUrl(requestUri, queryString);
if (targetUrl == null) {
- sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
+ sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法（缺失MinIO前缀）");
return;
}
- // 获取STS凭证
+ // 2. 获取并校验STS凭证（鉴权核心）
CredentialsDTO credentials = getCredentials();
if (credentials == null) {
- sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效");
+ sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效/缺失");
return;
}
+ // 3. 构建请求+转发响应（核心逻辑）
try {
- // 构建请求（区分大/小文件上传方式）
Request okRequest = buildRequest(request, method, targetUrl, credentials);
- // 执行并转发响应
forwardResponse(okRequest, response);
- log.info("STS代理请求成功 | 目标地址:{}", targetUrl);
+ log.info("STS代理请求成功 | 阶段:{} | 目标地址:{}", uploadStage, targetUrl);
} catch (Exception e) {
- log.error("STS代理请求执行异常", e);
- sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常：" + e.getMessage());
+ log.error("STS代理请求执行异常 | 阶段:{}", uploadStage, e);
+ // 友好错误提示：区分SSL/分块/鉴权错误
+ String errorMsg = e.getMessage().contains("SSL") ? "SSL连接异常（请检查MinIO HTTPS配置）" :
+ e.getMessage().contains("Credentials") ? "STS凭证异常" : "代理服务异常";
+ sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, errorMsg);
}
}
/**
- * 构造MinIO请求地址
+ * 识别分块上传阶段（日志优化）
+ */
+ private String getUploadStage(String queryString) {
+ if (queryString == null) return "普通请求";
+ if (queryString.contains("uploads") && !queryString.contains("uploadId")) return "分块初始化";
+ if (queryString.contains("partNumber") && queryString.contains("uploadId")) return "分块上传";
+ if (queryString.contains("uploadId") && !queryString.contains("partNumber")) return "分块合并";
+ return "普通请求";
+ }
+
+ /**
+ * 构造MinIO目标地址（兼容分块参数透传）
*/
private String buildTargetUrl(String requestUri, String queryString) {
try {
+ // 截取代理前缀后的路径（/minioTransfer/xxx → xxx）
String targetPath = requestUri.substring(PROXY_PREFIX.length());
StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
+ // 透传分块参数（uploads/uploadId/partNumber）
if (queryString != null && !queryString.isBlank()) {
urlBuilder.append("?").append(queryString);
}
return urlBuilder.toString();
} catch (Exception e) {
- log.error("目标地址构造失败", e);
+ log.error("构造MinIO目标地址失败", e);
return null;
}
}
/**
- * 获取并校验STS临时凭证
+ * 获取并校验STS凭证（确保AK/SK/Token完整）
*/
private CredentialsDTO getCredentials() {
try {
CredentialsDTO dto = ossService.getCredentials();
- if (dto == null || dto.getAccessKeyId() == null || dto.getSecurityToken() == null) {
- log.error("STS凭证核心字段缺失");
+ // 严格校验核心字段（避免鉴权失败）
+ if (dto == null || dto.getAccessKeyId() == null || dto.getAccessKeySecret() == null || dto.getSecurityToken() == null) {
+ log.error("STS凭证核心字段缺失：AK/SK/Token不能为空");
return null;
}
- log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId()); //.substring(0, 4) + "***"
+ log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
return dto;
} catch (Exception e) {
log.error("获取STS凭证异常", e);
@@ -172,57 +186,54 @@
}
/**
- * 构建OkHttp请求：核心优化大文件上传逻辑
+ * 构建OkHttp请求（适配分块上传的请求体/头透传）
*/
private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
Request.Builder builder = new Request.Builder().url(url);
- // 透传请求头：仅过滤Host，保留Content-Length
+ // 1. 透传所有请求头（排除Host，OkHttp自动处理）
Enumeration<String> headerNames = request.getHeaderNames();
while (headerNames.hasMoreElements()) {
String name = headerNames.nextElement();
- if (name.equalsIgnoreCase(HOST)) {
- continue;
+ if (!name.equalsIgnoreCase(HOST)) {
+ builder.addHeader(name, request.getHeader(name));
}
- builder.addHeader(name, request.getHeader(name));
}
- // 强制添加STS安全令牌
+ // 2. 添加STS鉴权头（MinIO分块上传必须）
builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
+ // 补充MinIO鉴权必要的头（防止签名失败）
+ builder.addHeader("X-Amz-Date", String.valueOf(System.currentTimeMillis()));
- // 构造请求体：区分GET/HEAD和其他方法
+ // 3. 构建请求体（区分小文件/大文件/分块合并XML）
RequestBody body = null;
if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
- long contentLength = request.getContentLengthLong();
InputStream inputStream = request.getInputStream();
+ long contentLength = request.getContentLengthLong();
- // 策略1：小文件（≤100MB）→ 预读取到字节数组，避免流式传输的连接不稳定
+ // 小文件：预读取到内存（稳定，适配分块上传的小文件块）
if (contentLength > 0 && contentLength <= MAX_MEMORY_SIZE) {
- log.info("小文件上传：预读取到内存，长度:{}MB", contentLength / 1024 / 1024);
+ log.info("小文件/分块上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
byte[] content = readInputStreamToBytes(inputStream);
- MediaType mediaType = request.getContentType() != null
- ? MediaType.parse(request.getContentType())
- : MediaType.parse("application/octet-stream");
+ MediaType mediaType = MediaType.parse(request.getContentType() == null ? "application/xml" : request.getContentType());
body = RequestBody.create(content, mediaType);
}
- // 策略2：大文件/未知长度 → 流式上传，优化超时和缓冲区
+ // 大文件/未知长度：流式上传（省内存，适配大文件分块）
else {
- log.info("大文件/未知长度上传：使用流式传输");
+ log.info("大文件/未知长度上传：使用流式传输（适配分块上传）");
body = new RequestBody() {
@Override
public MediaType contentType() {
- String contentType = request.getContentType();
- return contentType != null ? MediaType.parse(contentType) : MediaType.parse("application/octet-stream");
+ return MediaType.parse(request.getContentType() == null ? "application/xml" : request.getContentType());
}
@Override
public long contentLength() {
- return contentLength; // 返回原始长度，避免chunked编码
+ return contentLength; // 避免chunked编码，适配MinIO分块
}
@Override
public void writeTo(BufferedSink sink) throws IOException {
- // 优化：增加异常捕获和重试逻辑
byte[] buffer = new byte[BUFFER_SIZE];
int len;
long totalWritten = 0;
@@ -230,61 +241,61 @@
while ((len = in.read(buffer)) != -1) {
sink.write(buffer, 0, len);
totalWritten += len;
- // 每写100MB刷新一次，防止缓冲区溢出
+ // 每100MB刷新一次（防止缓冲区溢出）
if (totalWritten % (1024 * 1024 * 100) == 0) {
sink.flush();
- log.info("已上传：{}MB", totalWritten / 1024 / 1024);
+ log.info("分块上传进度：已写入{:.2f}MB", totalWritten / 1024.0 / 1024.0);
}
}
- sink.flush(); // 最终刷新
- log.info("流式上传完成，总写入：{}MB", totalWritten / 1024 / 1024);
- } catch (IOException e) {
- log.error("流式上传失败，已写入：{}MB", totalWritten / 1024 / 1024, e);
- throw e; // 抛出异常让上层处理
+ sink.flush();
+ log.info("流式上传完成，总写入：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
}
}
};
}
}
- builder.method(method, body);
- return builder.build();
+ return builder.method(method, body).build();
}
/**
- * 工具方法：读取InputStream到字节数组（小文件专用）
+ * 读取InputStream到字节数组（小文件/分块专用）
*/
private byte[] readInputStreamToBytes(InputStream inputStream) throws IOException {
- ByteArrayOutputStream bos = new ByteArrayOutputStream();
- byte[] buffer = new byte[BUFFER_SIZE];
- int len;
- while ((len = inputStream.read(buffer)) != -1) {
- bos.write(buffer, 0, len);
+ try (ByteArrayOutputStream bos = new ByteArrayOutputStream()) {
+ byte[] buffer = new byte[BUFFER_SIZE];
+ int len;
+ while ((len = inputStream.read(buffer)) != -1) {
+ bos.write(buffer, 0, len);
+ }
+ bos.flush();
+ return bos.toByteArray();
}
- bos.flush();
- byte[] result = bos.toByteArray();
- bos.close();
- return result;
}
/**
- * 执行请求并转发响应：增加响应体处理的容错
+ * 转发MinIO响应到客户端（关键：透传ETag/UploadId等分块参数）
*/
private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
try (Response okResponse = httpClient.newCall(request).execute()) {
- // 设置响应状态码
+ // 1. 基础响应配置（确保分块合并的XML响应正常透传）
response.setStatus(okResponse.code());
-
- // 透传响应头
- Headers headers = okResponse.headers();
- for (String name : headers.names()) {
- if (TRANSFER_ENCODING.equalsIgnoreCase(name)) {
- continue;
- }
- response.setHeader(name, headers.get(name));
+ response.setCharacterEncoding("UTF-8");
+ String contentType = okResponse.header("Content-Type");
+ if (contentType != null) {
+ response.setContentType(contentType); // 透传XML/JSON类型
}
- // 透传响应体：增加空判断和流关闭容错
+ // 2. 透传所有响应头（重点：ETag/UploadId等分块核心参数）
+ Headers headers = okResponse.headers();
+ for (String name : headers.names()) {
+ // 排除Transfer-Encoding（防止Tomcat重复编码）
+ if (!name.equalsIgnoreCase(TRANSFER_ENCODING)) {
+ response.setHeader(name, headers.get(name));
+ }
+ }
+
+ // 3. 透传响应体（分块初始化的UploadId、合并的成功响应等）
ResponseBody responseBody = okResponse.body();
if (responseBody != null) {
try (InputStream in = responseBody.byteStream()) {
@@ -294,21 +305,19 @@
response.getOutputStream().write(buffer, 0, len);
}
response.getOutputStream().flush();
- } catch (IOException e) {
- log.warn("响应体转发失败（客户端可能已断开连接）", e);
}
}
}
}
/**
- * 统一错误响应
+ * 统一返回错误响应
*/
private void sendError(HttpServletResponse response, int code, String msg) {
try {
response.sendError(code, msg);
} catch (IOException e) {
- log.error("响应错误信息失败", e);
+ log.error("发送错误响应失败", e);
}
}
}
\ No newline at end of file
--
Gitblit v1.9.3