# -*- coding: utf-8 -*-
from django import http
from django.template.loader import get_template
from django.template import Context
import ho.pisa as pisa
import cStringIO as StringIO
import cgi, os
 
 
def fetch_resources(uri, rel):
    path = '/path/para/diretorio/contendo/imagens/a/serem/exibidas'
    return path
 
def write_to_pdf(template_src, context_dict, filename):
    template = get_template(template_src)
    context = Context(context_dict)
    html  = template.render(context)
    result = StringIO.StringIO()
    pdf = pisa.pisaDocument(StringIO.StringIO(html.encode("UTF-8")), result, link_callback=fetch_resources)
    if not pdf.err:
        response = http.HttpResponse(mimetype='application/pdf')
        response['Content-Disposition'] = 'attachment; filename=%s.pdf' % filename
        response.write(result.getvalue())
        return response
    return http.HttpResponse('Problema ao gerar PDF: %s' % cgi.escape(html))

# views.py
from report import write_to_pdf
 
def listar_clientes_cadastrados(request):
    clientes = Cliente.objects.all()
    return write_to_pdf('relatorio.html', {'clientes': clientes}, 'nome_do_arquivo_pdf')

root@localhost: ~# wget http://downloads.sourceforge.net/project/kinterbasdb/kinterbasdb/kinterbasdb-3.2/kinterbasdb-3.2.src.tar.gz?use_mirror=ufpr
root@localhost: ~# tar zxvf kinterbasdb-3.2.src.tar.gz
root@localhost: ~# python setup.py build
Succeeded:
  /usr/bin/python setup.py build
root@localhost: ~# python setup.py install

root@localhost: ~# python -c "import kinterbasdb as k; print k.__version__"
(3, 2, 0, 'final', 0)
root@localhost: ~#

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
kinterbasdb.OperationalError: (-901, 'begin transaction: \n  invalid parameter in transaction parameter block')

root@localhost: ~# wget https://firebird.svn.sourceforge.net/svnroot/firebird/qa/trunk/kinterbasdb/__init__.py
root@localhost: ~# mv __init__.py /usr/lib/python2.5/site-packages/kinterbasdb/

import kinterbasdb
conn = kinterbasdb.connect(
    host='192.168.0.2',
    database='C:\\Dados\\meubanco.fdb',
    user='sysdba',
    password='masterkey'
)
cur = conn.cursor()
cur.execute('SELECT id, nome, telefone FROM tabela')
for (id, nome, telefone) in cur:
    print 'ID: %s, Nome: %s, Fone: %s' % (id, nome, telefone)

# views.py
 
from django.views.generic.simple import direct_to_template
from django.forms import forms, fields
 
def montar_formulario_dinamico(request):
    campos_dinamicos = {
        'nome': fields.CharField(max_length=100, required=True, label='Nome', initial='Gustavo'),
        'idade': fields.IntegerField(label='Idade', min_value=0),
        'email': fields.EmailField(max_length=200, required=False, label='E-mail')
    }
 
    FormDinamico = type('', (forms.Form,), campos_dinamicos)
    form = FormDinamico()
 
    return direct_to_template(request, 'formulario.html', extra_context={'formulario': form})

root@localhost# apt-get install apache2 libapache2-mod-wsgi sqlite3 python-pysqlite2 python-django

root@localhost: /var/www# tar zxvf gustavohenrique-bandcontrol-XXXXXX.tar.gz
root@localhost: /var/www# mv gustavohenrique-bandcontrol-XXXXXX bandcontrol
root@localhost: /var/www# chown www-data.www-data -Rf bandcontrol

root@localhost: /var/www# chmod +w /etc/sudoers
root@localhost: /var/www# vim /etc/sudoers

# No Ubuntu o iptables e o tc estao dentro do /sbin
Cmd_Alias BANDCONTROL = /sbin/iptables, /sbin/tc
www-data  ALL = (ALL) NOPASSWD: BANDCONTROL

WSGIRestrictStdout Off
NameVirtualHost bandcontrol
<VirtualHost bandcontrol>
        ServerAdmin webmaster@localhost
        LimitInternalRecursion 1000
        ServerName bandcontrol
 
        <Directory /var/www/bandcontrol>
                Options ExecCGI FollowSymLinks MultiViews
                AllowOverride FileInfo
                MultiviewsMatch Handlers
                Order deny,allow
                Allow from all
        </Directory>
 
        ErrorLog /var/log/apache2/bandcontrol_error.log
        CustomLog /var/log/apache2/bandcontrol_access.log combined
 
        WSGIScriptAlias /     "/var/www/bandcontrol/config.wsgi"
 
        Alias /admin_media/ "/usr/lib/pymodules/python2.6/django/contrib/admin/media/"
        Alias /media/           "/var/www/bandcontrol/media/"
</VirtualHost>

127.0.0.2     bandcontrol

import os, sys
PROJECT_ROOT_PATH = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, PROJECT_ROOT_PATH)
sys.path.append('/usr/lib/pymodules/python2.6/django/')
sys.path.append('/var/www')
os.environ['DJANGO_SETTINGS_MODULE']='settings'
import django.core.handlers.wsgi
application = django.core.handlers.wsgi.WSGIHandler()
 
import bandcontrol.monitor
bandcontrol.monitor.start(interval=1.0)

root@localhost: /var/www/bandcontrol# python manage.py syncdb
Creating table auth_permission
Creating table auth_group
Creating table auth_user
Creating table auth_message
Creating table django_content_type
Creating table django_session
Creating table django_site
Creating table django_admin_log
Creating table rede_plano
Creating table rede_pontorede
 
You just installed Django's auth system, which means you don't have any superusers defined.
Would you like to create one now? (yes/no): yes
Username (Leave blank to use 'root'): gustavo
E-mail address: eu@gustavohenrique.net
Password:
Password (again):
Superuser created successfully.
Installing index for auth.Permission model
Installing index for auth.Message model
Installing index for admin.LogEntry model
Installing index for rede.PontoRede model

#!/bin/bash
 
ARQUIVO="/var/www/bandcontrol/scripts/pontosderede.txt"     # Contem os pontos de rede cadastrados
 
MOD=$(which modprobe)                        # Comando para carregar modulos do kernel
IPT=$(which iptables)                        # Caminho do iptables
TC=$(which tc)                               # tc (pacote iproute2)
 
I_WAN="eth0"                                 # Interface internet
I_LAN1="eth1"                                # Interface Rede local
 
GATEWAY_IP="192.168.254.254"
NETMASK="255.255.255.0"
CLASSE_LAN1="192.168.254"                    # Classe de IP utilizada na rede local. Ex.: 10.0
PROXY_SERVER="$GATEWAY_IP:3128"              # O proprio gateway tambem roda o Squid na porta 3128
 
DHCPD_DAEMON="/etc/init.d/dhcp3-server"      # Executavel do dhcpd server
DHCPDCONF="/etc/dhcp3/dhcpd.conf"            # Arquivo de configuracao do dhcpd
DOMINIO="gustavohenrique.net"                # Dominio ao qual a rede faz parte
DNS_SERVERS="$GATEWAY_IP, 8.8.8.8, 4.2.2.2"  # Servidores DNS. O primeiro é o próprio gateway
 
# Remove o controle de banda
function parar_controle_de_banda {
    $TC qdisc del dev $I_LAN1 root
    $TC qdisc del dev $I_WAN root
}
 
# Cria as regras iniciais para controle de banda
function iniciar_controle_de_banda {
    # Remove as regras do controle de banda
    parar_controle_de_banda
 
    # Download
    $TC qdisc add dev $I_LAN1 root handle 1 cbq bandwidth 100Mbit avpkt 1000 cell 8
    $TC class change dev $I_LAN1 root cbq weight 10Mbit allot 1514
 
    # Upload
    $TC qdisc add dev $I_WAN root handle 1 cbq bandwidth 100Mbit avpkt 1000 cell 8
    $TC class change dev $I_WAN root cbq weight 10Mbit allot 1514
 
    # Cache Full. Pacotes marcados com TOS 60 vao para a classe 1:9999 cuja banda é 100 Mbit (rede ethernet)
    $TC class add dev $I_LAN1 parent 1: classid 1:9999 cbq bandwidth 100Mbit rate 100Mbit weight 10Mbit prio 4 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded
    $TC filter add dev $I_LAN1 parent 1:0 protocol ip prio 3 u32 match ip protocol 0x6 0xff match ip tos 60 0xff classid 1:9999  
}
 
 
# Limpa o firewall
function parar_firewall() {
    # Configura a politca padrao para aceitar tudo
    $IPT -P INPUT ACCEPT
    $IPT -P OUTPUT ACCEPT
    $IPT -P FORWARD ACCEPT
    $IPT -t nat -P PREROUTING ACCEPT
 
    # Limpa a tabela netfilter
    $IPT -F
    $IPT -X
    $IPT -t nat -F
    $IPT -t nat -X
    $IPT -t mangle -F
    $IPT -t mangle -X
}
 
 
# Cria as regras de firewall
function iniciar_firewall() {
 
    # Finaliza o script se nao existir o arquivo contendo os pontos de rede
    if [ ! -f $ARQUIVO ]; then
        echo "Arquivo contendo os pontos de rede ($ARQUIVO) nao existe.";
        exit 0
    fi
 
    # Carrega modulos do iptables
    $MOD ip_tables
    $MOD iptable_nat
    $MOD ipt_MASQUERADE
    $MOD ipt_LOG
    $MOD ipt_REJECT
    $MOD ip_conntrack_ftp
    $MOD ip_nat_ftp
 
    # Limpa todas as regras do firewall
    parar_firewall
 
    # Recria as regras para controle de banda
    iniciar_controle_de_banda
 
    # Por padrao bloqueia tudo que for entrar no firewall
    $IPT -P INPUT DROP
    $IPT -t nat -P PREROUTING DROP
 
    # Habilita redirecionamento de pacotes para compartilhar internet
    echo 1 > /proc/sys/net/ipv4/ip_forward
 
    # Aumenta o limite do nf_conntrack_max
    echo 99999 > /proc/sys/net/netfilter/nf_conntrack_max
 
    # Libera acesso para pacotes vindos da internet (CUIDADO)
    $IPT -t nat -A PREROUTING -s 0/0 -i $I_WAN -p all -j ACCEPT
    $IPT -A INPUT -i $I_WAN -j ACCEPT
 
    # Cria uma nova chain para tratar do proxy transparente
    $IPT -t nat -N proxy
        # O software conectividade social da Caixa Economica nao funciona se
        # estiver passando pelo proxy. Tudo que for destinado ao IP da Caixa
        # nao vai passar pelo proxy
        $IPT -t nat -A proxy -p tcp -d 200.201.174.0/16 --dport 80 -j ACCEPT
        $IPT -t nat -A proxy -p tcp -d 200.201.173.0/16 --dport 80 -j ACCEPT
        $IPT -t nat -A proxy -p tcp -d 200.201.0.0/16 --dport 80 -j ACCEPT
        $IPT -t nat -A proxy -p tcp -d 200.201.174.207 --dport 80 -j ACCEPT
 
        # Internet Caixa nao passa pelo proxy
        $IPT -t nat -A proxy -p tcp -d 200.201.169.0/8 --dport 80 -j ACCEPT
        $IPT -t nat -A proxy -p tcp -d 200.201.169.69 --dport 80 -j ACCEPT
 
        # Esse servidor tambem roda o Apache na port 80. Nao quero que as
        # paginas locais passem pelo proxy, pois assim posso controlar a banda
        # de pacotes vindos do apache definindo a velocidade máxima da rede
        $IPT -t nat -A proxy -p tcp -d $GATEWAY_IP --dport 80 -j ACCEPT
 
        # Proxy transparente redirecionando os pacotes para a porta do Squid
        $IPT -t nat -A proxy -s 0/0 -p tcp --dport 80 -j DNAT --to-dest $PROXY_SERVER
 
        # Se o pacote nao for pra porta 80 (não é navegação), deixa passar
        $IPT -t nat -A proxy -i $I_LAN1 -j ACCEPT
 
 
    # Libera o IP abaixo sem amarrar com MAC e sem passar pelo proxy
    #$IPT -t nat -A PREROUTING -i $I_LAN1 -s 192.168.254.2 -j ACCEPT
 
    # Configuracao inicial do dhcpd.conf. Distribuicao de IPs na faixa 192.168.254.80 a 192.168.254.90
    echo "# Arquivo dhcpd.conf criado pelo BandControl" > $DHCPDCONF
    echo "ddns-update-style none;" >> $DHCPDCONF
    echo "option domain-name \"$DOMINIO\";" >> $DHCPDCONF
    echo "option domain-name-servers $DNS_SERVERS;" >> $DHCPDCONF
    echo "default-lease-time 600;" >> $DHCPDCONF
    echo "max-lease-time 7200;" >> $DHCPDCONF
    echo "authoritative;" >> $DHCPDCONF
    echo "shared-network 0-2 {" >> $DHCPDCONF
    echo "  subnet $CLASSE_LAN1"."0 netmask $NETMASK { range $CLASSE_LAN1.80 $CLASSE_LAN1.90; }" >> $DHCPDCONF
    echo "}" >> $DHCPDCONF
 
    # Inicio do loop para liberacao e bloqueio de clientes.
    # O formato do arquivo é: codigo_identificador-descricao-ip-mac-download-upload-liberado-proxy
    # Ex.: 1-gustavo_henrique_notebook-192.168.254.10-512-256-S-S
    # Acesso liberado e uso do proxy sao valores que devem ser True ou False
    for i in `cat $ARQUIVO`; do
        CODIGO=$(echo $i | awk -F "-" {'print $1'})                  # Numero usado como identificador no controle de banda
        IP=$(echo $i | awk -F "-" {'print $3'})                      # IP
        MAC=$(echo $i | awk -F "-" {'print $4'})                     # MAC em letras minusculas e separado por dois pontos (:)
        DOWNLOAD=$(echo $i | awk -F "-" {'print $5'})                # Numero correspondente a velocidade de download em Kbit
        UPLOAD=$(echo $i | awk -F "-" {'print $6'})                  # Numero correspondente a velocidade de upload em Kbit
        POSSUI_ACESSO_LIBERADO=$(echo $i | awk -F "-" {'print $7'})  # True para sim, False para bloquear o acesso
        VAI_USAR_PROXY=$(echo $i | awk -F "-" {'print $8'})          # True para usar o proxy, False para não usar
 
        # Configurar dhcpd para associar IP ao MAC
        if [ "$MAC" != "" ]; then
          LINHA="host $CODIGO { hardware ethernet $MAC; fixed-address $IP; option subnet-mask $NETMASK; option routers $GATEWAY_IP; option domain-name-servers $DNS_SERVERS; }"
          echo $LINHA >> $DHCPDCONF
        fi
 
        # Se o IP nao esta liberado, bloqueia no firewall
        if [ "$POSSUI_ACESSO_LIBERADO" == "False" ]; then
            EXECUTAR_REGRA="$IPT -t nat -A PREROUTING -p tcp -i $I_LAN1 -s $IP -j DROP"
        else
            if [ "$VAI_USAR_PROXY" == "True" ]; then
                EXECUTAR_REGRA="$IPT -t nat -A PREROUTING -i $I_LAN1 -s $IP -m mac --mac-source $MAC -j proxy"
            else
                EXECUTAR_REGRA="$IPT -t nat -A PREROUTING -i $I_LAN1 -s $IP -j ACCEPT"
            fi
        fi
 
        # Executa a regra referente ao IP dentro do loop
        $EXECUTAR_REGRA
 
 
        # Aplica o controle de banda ao IP. Para cada IP é criada uma classe de download e upload.
        WEIGHT_DOWN=$(expr $DOWNLOAD / 10)
        ID_DOWN=1"$CODIGO"
        $TC class add dev $I_LAN1 parent 1: classid 1:$ID_DOWN cbq bandwidth 10Mbit rate "$DOWNLOAD"Kbit weight "$WEIGHT_DOWN"Kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded
        $TC filter add dev $I_LAN1 parent 1:0 protocol ip prio 100 u32 match ip dst $IP classid 1:$ID_DOWN
 
        WEIGHT_UP=$(expr $UPLOAD / 10)
        ID_UP=2"$CODIGO"
        $TC class add dev $I_WAN parent 1: classid 1:$ID_UP cbq bandwidth 10Mbit rate "$UPLOAD"Kbit weight "$WEIGHT_UP"Kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded
        $TC qdisc add dev $I_WAN parent 1:$ID_UP handle $ID_UP tbf rate "$UPLOAD"Kbit buffer 10Kb/8 limit 15Kb mtu 1500
        $TC filter add dev $I_WAN parent 1:0 protocol ip prio 100 u32 match ip src $IP classid 1:$ID_UP
 
    done
 
    # Aplica o TOS 60 nas portas utilizadas por outros serviços. Assim é usado a velocidade total da rede
    # para acesso ao SSH, Apache e Samba
    $IPT -t mangle -A OUTPUT -p tcp --sport 22 -j TOS --set-tos 60
    $IPT -t mangle -A OUTPUT -p tcp --sport 80 -j TOS --set-tos 60
 
    $IPT -t mangle -A OUTPUT -p tcp --sport 137:139 -j TOS --set-tos 60
    $IPT -t mangle -A OUTPUT -p udp --sport 137:139 -j TOS --set-tos 60
    $IPT -t mangle -A INPUT -p tcp --dport 137:139 -j TOS --set-tos 60
    $IPT -t mangle -A INPUT -p udp --dport 137:139 -j TOS --set-tos 60
 
    # Compartilha a internet
    $IPT -t nat -A POSTROUTING -o $I_WAN -j MASQUERADE
 
    # Bloqueio contra Scanners Ocultos (Shealt Scan)
    $IPT -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j DROP
 
    # Libera ping (CUIDADO com ataques ddos)
    $IPT -A INPUT -i $I_LAN1 -p icmp -j ACCEPT
    $IPT -A INPUT -i $I_WAN -p icmp -j ACCEPT
 
    # Libera acesso para o proprio gateway
    $IPT -A INPUT -i lo -j ACCEPT
    $IPT -A FORWARD -i lo -j ACCEPT
 
    # Libera acesso ao Apache
    $IPT -A INPUT -p tcp --dport 80 -j ACCEPT
    $IPT -A INPUT -p tcp --dport 443 -j ACCEPT
 
    # Libera acesso ao Squid
    $IPT -A INPUT -p tcp --dport 3128 -j ACCEPT
 
    # Libera acesso ao SSH
    $IPT -A INPUT -p tcp --dport 22 -j ACCEPT
 
    # Libera acesso ao DNS
    $IPT -A INPUT -p udp --dport 53 -j ACCEPT
 
    # Libera acesso aos compartilhamentos do Samba
    $IPT -A INPUT -p tcp --dport 137:139 -j ACCEPT
    $IPT -A INPUT -p udp --dport 137:139 -j ACCEPT
 
    # Libera acesso ao SNMP
    #$IPT -A INPUT -p udp --dport 160:162 -j ACCEPT
 
    # Tratamento de conexoes TCP
    $IPT -A INPUT -p tcp --syn -j DROP
    $IPT -A INPUT -p tcp -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
    $IPT -A INPUT -m limit --limit 3/minute --limit-burst 3 -j DROP
 
    # Bloqueando pacotes estranhos
    $IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
    $IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
    $IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
    $IPT -A INPUT -p tcp --tcp-flags ALL FIN -j DROP
    $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
    $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
    $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 
    echo "Firewall iniciado"
}
 
 
case $1 in
    # Inicia o firewall e o dhcpd
    start) iniciar_firewall; $DHCPD_DAEMON stop; $DHCPD_DAEMON start; exit ;;
 
    # Finaliza o firewall sem parar o dhcp
    stop) parar_firewall; exit ;;
 
    # Inicia o firewall sem reiniciar o dhcpd
    only) iniciar_firewall; exit ;;
 
    # Finaliza o controle de banda
    fast) parar_controle_de_banda; exit ;;
 
    # Se nenhum parametro for passado, mostra a ajuda abaixo
    *) echo "Use assim: $0 start|stop|only|fast"; exit 1;;
esac

root@localhost:~# wget http://zph.bratcheda.org/squid-3.0.STABLE8-zph.patch
root@localhost:~# apt-get source squid3
root@localhost:~# apt-get build-dep squid3
root@localhost:~# cd squid3-3.0.STABLE8
root@localhost:~/squid3-3.0.STABLE8# patch -p1 ../squid-3.0.STABLE8-zph.patch
root@localhost:~/squid3-3.0.STABLE8# dpkg-buildpackage -rfakeroot -uc -b

root@localhost:~/squid3-3.0.STABLE8# cd ..
root@localhost:~# dpkg -i squid3_3.0.STABLE8-3+lenny2build0.9.04.1_i386.deb
root@localhost:~# dpkg -i squid3-common_3.0.STABLE8-3+lenny2build0.9.04.1_all.deb
root@localhost:~# dpkg -i squid3-cgi_3.0.STABLE8-3+lenny2build0.9.04.1_i386.deb
root@localhost:~# dpkg -i squidclient_3.0.STABLE8-3+lenny2build0.9.04.1_i386.deb

acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 192.168.254.0/24
acl SSL_ports port 443
acl Safe_ports port 80		# http
acl Safe_ports port 21		# ftp
acl Safe_ports port 443		# https
acl Safe_ports port 70		# gopher
acl Safe_ports port 210		# wais
acl Safe_ports port 1025-65535	# unregistered ports
acl Safe_ports port 280		# http-mgmt
acl Safe_ports port 488		# gss-http
acl Safe_ports port 591		# filemaker
acl Safe_ports port 777		# multiling http
acl CONNECT method CONNECT
 
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all
 
icp_access allow localnet
icp_access deny all
htcp_access allow localnet
htcp_access deny all
 
# Porta
http_port 3128 transparent
 
hierarchy_stoplist cgi-bin ?
maximum_object_size_in_memory 64 KB
cache_dir aufs /var/cache/squid 40000 16 256
max_open_disk_fds 0
 
# Marcacao TOS do ZPH
zph_tos_local 16
zph_tos_parent on
 
# Arquivos de LOG
access_log /var/log/squid3/access.log squid
cache_log /var/log/squid3/cache.log
cache_store_log /var/log/squid3/store.log
 
# PID
pid_filename /var/run/squid.pid
 
refresh_pattern ^ftp:		1440	20%	10080
refresh_pattern ^gopher:	1440	0%	1440
refresh_pattern (cgi-bin|\?)	0	0%	0
refresh_pattern .		0	20%	4320
visible_hostname mainserver
icp_port 3130
coredump_dir /var/cache

root@localhost:~# squid -z
root@localhost:~# /etc/init.d/squid3 start