text:
Researchers advice to Think Beyond the Bladder for Interstitial Cystitis Pain
When evaluating women with pelvic pain, consider the vestibule, says an urologist and sexual medicine specialist who says clinicians should stop ignoring this underappreciated component of the female anatomy. The study is presented at the Sexual Medicine Society of North America (SMSNA) Fall 2017 Scientific Meeting.
Kidney Transplant Infection Identified with the aid of Novel Nuclear Medicine Test
A novel nuclear medicine test was developed by German scientists which could determine whether a kidney transplant patient had developed infection in the transplanted tissue. The study, which utilizes positron emission tomography/magnetic resonance imaging (PET/MRI), is presented in the December issue of The Journal of Nuclear Medicine.
Health Hazards: Fake social media accounts for the cause
According to the USC researchers reports, the fake social media accounts for the health hazards. These social medias already have a reputation of swaying political discourse, but a new study shows these automated accounts are even more dangerous — they can be bad for your health. Researchers focused on how these bots promoted the notion that using electronic cigarettes helps people stop smoking, a conclusion not definitively supported by research.
'Male Athlete Triad' Syndrome, more insights
The American College of Sports Medicine plans to convene a panel at its annual meeting in Minneapolis to take on the task. "It's likely the term 'male athlete triad'," says Mary Jane De Souza from Pennsylvania State University.
Persistent Virus Plays No Role in Chikungunya Associated Arthritis
Chikungunya virus (CHIKV) infection, a mosquito-borne disease reported in the Americas in 2013, leaves about one quarter of those infected with persistent arthritis, according to a study published in the journal Arthritis & Rheumatology. The joint symptoms, however, do not appear to be associated with persistent infection, suggesting it is safe to treat patients with regimens used for other types of inflammatory arthritis.
Rohingya at Risk of Diphtheria Face Medic Shortage
According to aid officials, health workers in Rohingya refugee camps in Bangladesh are struggling with a shortage of medics able to administer antitoxins to patients infected with diphtheria that has killed nearly two dozen people.
General Anesthesia, Opioid-Free Is Given For Spine Surgery Using Drugs
Researchers showed the case of a 65-year-old man undergoing a two-level lumbosacral posterior spinal fusion under general anesthesia using dexmedetomidine, lidocaine, and nitrous oxide, without the use of any intraoperative opioids and minimal opioids postoperatively for 24 h. To our knowledge, this is the first report documenting this anesthetic technique and its benefits through the first postoperative day.
Adjunctive Rifampin Shows No Benefit for Staph aureus Bacteremia
A new study published in The Lancet suggest that adjunctive rifampin, also called rifampicin, provides no significant benefit over standard antibiotic therapy in patients with Staphylococcus aureus bacteremia.
Adsorbent Drug can Protect Microbiome from Antibiotics
According to a study published in the Journal of Infectious Diseases an experimental product based on activated charcoal may help shield the gut microbiome from disruption by antibiotics. The new adsorbent breakthrough could lead to the prevention from health consequences of antibiotic treatments.
In Circadian Rhythm, Sense of Smelling Differs
According to a new study, Researchers who are looking at how sleep may influence eating patterns in teens. A person's ability to smell may vary throughout the day in accordance with their circadian rhythm. It has always been apparent that some individuals have a better sense of smell than others, but a new study of 37 teens provides the first direct evidence that within each person, smell sensitivity varies over the course of each day. It tracks with the body's internal day-night cycle, or circadian rhythm. This study got published in Chemical Senses.
Thyroid Hormone Develops Angiogenesis In Liver Cancer
Thyroid hormone, 3, 3′, 5-triiodo-l-thyronine (T3), mediates several physiological processes, including embryonic development, cellular differentiation and cell proliferation, via binding to its nuclear thyroid receptors (TR). Angiogenesis is essential for human cancer development. The angiogenic process is balanced by the positive regulator, vascular endothelial growth factor (VEGF) and the negative regulator, thrombospondin-1 (TSP-1).
In A Helical Protein, Molecular Recognition and Packing Was Detected
A new study on Biomolecules has been demonstrated by showing the Folding of globular proteins entails a similar discrimination. To gain physical insight, we computed the binding affinities of helical structures of the protein Im9 in various native or nonnative configurations by atomic simulations, discovering that partial packing of the Im9 core is frustrated. This frustration is overcome when the entire core of the protein is assembled, consistent with experiment indicating no significant kinetic trapping in Im9 folding.
234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991,0001,0011,0021,0031,0041,0051,0061,0071,0081,0091,0101,0111,0121,0131,0141,0151,0161,0171,0181,0191,0201,0211,0221,0231,0241,0251,0261,0271,0281,0291,0301,0311,0321,0331,0341,0351,0361,0371,0381,0391,0401,0411,0421,0431,0441,0451,0461,0471,0481,0491,0501,0511,0521,0531,0541,0551,0561,0571,0581,0591,0601,0611,0621,0631,0641,0651,0661,0671,0681,0691,0701,0711,0721,0731,0741,0751,0761,0771,0781,0791,0801,0811,0821,0831,0841,0851,0861,0871,0881,0891,0901,0911,0921,0931,0941,0951,0961,0971,0981,0991,1001,1011,1021,1031,1041,1051,1061,1071,1081,1091,1101,1111,1121,1131,1141,1151,116
1,1221,1231,124


text:
#include <sys/cdefs.h>
__FBSDID("$FreeBSD: head/sys/netpfil/ipfw/ip_fw_dynamic.c 243882 2012-12-05 08:04:20Z glebius $");

#define        DEB(x)
#define        DDB(x) x

/*
 * Dynamic rule support for ipfw
 */

#include "opt_ipfw.h"
#include "opt_inet.h"
#ifndef INET
#error IPFIREWALL requires INET.
#endif /* INET */
#include "opt_inet6.h"

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/kernel.h>
#include <sys/ktr.h>
#include <sys/lock.h>
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <sys/syslog.h>
#include <net/ethernet.h> /* for ETHERTYPE_IP */
#include <net/if.h>
#include <net/if_var.h>
#include <net/vnet.h>

#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>	/* ip_defttl */
#include <netinet/ip_fw.h>
#include <netinet/tcp_var.h>
#include <netinet/udp.h>

#include <netinet/ip6.h>	/* IN6_ARE_ADDR_EQUAL */
#ifdef INET6
#include <netinet6/in6_var.h>
#include <netinet6/ip6_var.h>
#endif

#include <netpfil/ipfw/ip_fw_private.h>

#include <machine/in_cksum.h>	/* XXX for in_cksum */

#ifdef MAC
#include <security/mac/mac_framework.h>
#endif

/*
 * Description of dynamic rules.
 *
 * Dynamic rules are stored in lists accessed through a hash table
 * (ipfw_dyn_v) whose size is curr_dyn_buckets. This value can
 * be modified through the sysctl variable dyn_buckets which is
 * updated when the table becomes empty.
 *
 * XXX currently there is only one list, ipfw_dyn.
 *
 * When a packet is received, its address fields are first masked
 * with the mask defined for the rule, then hashed, then matched
 * against the entries in the corresponding list.
 * Dynamic rules can be used for different purposes:
 *  + stateful rules;
 *  + enforcing limits on the number of sessions;
 *  + in-kernel NAT (not implemented yet)
 *
 * The lifetime of dynamic rules is regulated by dyn_*_lifetime,
 * measured in seconds and depending on the flags.
 *
 * The total number of dynamic rules is equal to UMA zone items count.
 * The max number of dynamic rules is dyn_max. When we reach
 * the maximum number of rules we do not create anymore. This is
 * done to avoid consuming too much memory, but also too much
 * time when searching on each packet (ideally, we should try instead
 * to put a limit on the length of the list on each bucket...).
 *
 * Each dynamic rule holds a pointer to the parent ipfw rule so
 * we know what action to perform. Dynamic rules are removed when
 * the parent rule is deleted. This can be changed by dyn_keep_states
 * sysctl.
 *
 * There are some limitations with dynamic rules -- we do not
 * obey the 'randomized match', and we do not do multiple
 * passes through the firewall. XXX check the latter!!!
 */

struct ipfw_dyn_bucket {
	struct mtx	mtx;		/* Bucket protecting lock */
	ipfw_dyn_rule	*head;		/* Pointer to first rule */
};

/*
 * Static variables followed by global ones
 */
static VNET_DEFINE(struct ipfw_dyn_bucket *, ipfw_dyn_v);
static VNET_DEFINE(u_int32_t, dyn_buckets_max);
static VNET_DEFINE(u_int32_t, curr_dyn_buckets);
static VNET_DEFINE(struct callout, ipfw_timeout);
#define	V_ipfw_dyn_v			VNET(ipfw_dyn_v)
#define	V_dyn_buckets_max		VNET(dyn_buckets_max)
#define	V_curr_dyn_buckets		VNET(curr_dyn_buckets)
#define V_ipfw_timeout                  VNET(ipfw_timeout)

static VNET_DEFINE(uma_zone_t, ipfw_dyn_rule_zone);
#define	V_ipfw_dyn_rule_zone		VNET(ipfw_dyn_rule_zone)

#define	IPFW_BUCK_LOCK_INIT(b)	\
	mtx_init(&(b)->mtx, "IPFW dynamic bucket", NULL, MTX_DEF)
#define	IPFW_BUCK_LOCK_DESTROY(b)	\
	mtx_destroy(&(b)->mtx)
#define	IPFW_BUCK_LOCK(i)	mtx_lock(&V_ipfw_dyn_v[(i)].mtx)
#define	IPFW_BUCK_UNLOCK(i)	mtx_unlock(&V_ipfw_dyn_v[(i)].mtx)
#define	IPFW_BUCK_ASSERT(i)	mtx_assert(&V_ipfw_dyn_v[(i)].mtx, MA_OWNED)

static VNET_DEFINE(int, dyn_keep_states);
#define	V_dyn_keep_states		VNET(dyn_keep_states)

/*
 * Timeouts for various events in handing dynamic rules.
 */
static VNET_DEFINE(u_int32_t, dyn_ack_lifetime);
static VNET_DEFINE(u_int32_t, dyn_syn_lifetime);
static VNET_DEFINE(u_int32_t, dyn_fin_lifetime);
static VNET_DEFINE(u_int32_t, dyn_rst_lifetime);
static VNET_DEFINE(u_int32_t, dyn_udp_lifetime);
static VNET_DEFINE(u_int32_t, dyn_short_lifetime);

#define	V_dyn_ack_lifetime		VNET(dyn_ack_lifetime)
#define	V_dyn_syn_lifetime		VNET(dyn_syn_lifetime)
#define	V_dyn_fin_lifetime		VNET(dyn_fin_lifetime)
#define	V_dyn_rst_lifetime		VNET(dyn_rst_lifetime)
#define	V_dyn_udp_lifetime		VNET(dyn_udp_lifetime)
#define	V_dyn_short_lifetime		VNET(dyn_short_lifetime)

/*
 * Keepalives are sent if dyn_keepalive is set. They are sent every
 * dyn_keepalive_period seconds, in the last dyn_keepalive_interval
 * seconds of lifetime of a rule.
 * dyn_rst_lifetime and dyn_fin_lifetime should be strictly lower
 * than dyn_keepalive_period.
 */

static VNET_DEFINE(u_int32_t, dyn_keepalive_interval);
static VNET_DEFINE(u_int32_t, dyn_keepalive_period);
static VNET_DEFINE(u_int32_t, dyn_keepalive);
static VNET_DEFINE(time_t, dyn_keepalive_last);

#define	V_dyn_keepalive_interval	VNET(dyn_keepalive_interval)
#define	V_dyn_keepalive_period		VNET(dyn_keepalive_period)
#define	V_dyn_keepalive			VNET(dyn_keepalive)
#define	V_dyn_keepalive_last		VNET(dyn_keepalive_last)

static VNET_DEFINE(u_int32_t, dyn_max);		/* max # of dynamic rules */

#define	DYN_COUNT			uma_zone_get_cur(V_ipfw_dyn_rule_zone)
#define	V_dyn_max			VNET(dyn_max)

/* for userspace, we emulate the uma_zone_counter with ipfw_dyn_count */
static int ipfw_dyn_count;	/* number of objects */

#ifdef USERSPACE /* emulation of UMA object counters for userspace */
#define uma_zone_get_cur(x)	ipfw_dyn_count
#endif /* USERSPACE */

static int last_log;	/* Log ratelimiting */

static void ipfw_dyn_tick(void *vnetx);
static void check_dyn_rules(struct ip_fw_chain *, struct ip_fw *,
    int, int, int);
#ifdef SYSCTL_NODE

static int sysctl_ipfw_dyn_count(SYSCTL_HANDLER_ARGS);
static int sysctl_ipfw_dyn_max(SYSCTL_HANDLER_ARGS);

SYSBEGIN(f2)

SYSCTL_DECL(_net_inet_ip_fw);
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_buckets,
    CTLFLAG_RW, &VNET_NAME(dyn_buckets_max), 0,
    "Max number of dyn. buckets");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, curr_dyn_buckets,
    CTLFLAG_RD, &VNET_NAME(curr_dyn_buckets), 0,
    "Current Number of dyn. buckets");
SYSCTL_VNET_PROC(_net_inet_ip_fw, OID_AUTO, dyn_count,
    CTLTYPE_UINT|CTLFLAG_RD, 0, 0, sysctl_ipfw_dyn_count, "IU",
    "Number of dyn. rules");
SYSCTL_VNET_PROC(_net_inet_ip_fw, OID_AUTO, dyn_max,
    CTLTYPE_UINT|CTLFLAG_RW, 0, 0, sysctl_ipfw_dyn_max, "IU",
    "Max number of dyn. rules");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_ack_lifetime,
    CTLFLAG_RW, &VNET_NAME(dyn_ack_lifetime), 0,
    "Lifetime of dyn. rules for acks");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_syn_lifetime,
    CTLFLAG_RW, &VNET_NAME(dyn_syn_lifetime), 0,
    "Lifetime of dyn. rules for syn");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_fin_lifetime,
    CTLFLAG_RW, &VNET_NAME(dyn_fin_lifetime), 0,
    "Lifetime of dyn. rules for fin");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_rst_lifetime,
    CTLFLAG_RW, &VNET_NAME(dyn_rst_lifetime), 0,
    "Lifetime of dyn. rules for rst");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_udp_lifetime,
    CTLFLAG_RW, &VNET_NAME(dyn_udp_lifetime), 0,
    "Lifetime of dyn. rules for UDP");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_short_lifetime,
    CTLFLAG_RW, &VNET_NAME(dyn_short_lifetime), 0,
    "Lifetime of dyn. rules for other situations");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_keepalive,
    CTLFLAG_RW, &VNET_NAME(dyn_keepalive), 0,
    "Enable keepalives for dyn. rules");
SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_keep_states,
    CTLFLAG_RW, &VNET_NAME(dyn_keep_states), 0,
    "Do not flush dynamic states on rule deletion");

SYSEND

#endif /* SYSCTL_NODE */

#ifdef INET6
static __inline int
hash_packet6(struct ipfw_flow_id *id)
{
	u_int32_t i;
	i = (id->dst_ip6.__u6_addr.__u6_addr32[2]) ^
	    (id->dst_ip6.__u6_addr.__u6_addr32[3]) ^
	    (id->src_ip6.__u6_addr.__u6_addr32[2]) ^
	    (id->src_ip6.__u6_addr.__u6_addr32[3]) ^
	    (id->dst_port) ^ (id->src_port);
	return i;
}
#endif /* INET6 */

/*
 * IMPORTANT: the hash function for dynamic rules must be commutative
 * in source and destination (ip,port), because rules are bidirectional
 * and we want to find both in the same bucket.
 */
static __inline int
hash_packet(struct ipfw_flow_id *id, int buckets)
{
	u_int32_t i;

#ifdef INET6
	if (IS_IP6_FLOW_ID(id))
		i = hash_packet6(id);
	else
#endif /* INET6 */
	i = (id->dst_ip) ^ (id->src_ip) ^ (id->dst_port) ^ (id->src_port);
	i &= (buckets - 1);
	return i;
}

/**
 * Print customizable flow id description via log(9) facility.
 */
static void
print_dyn_rule_flags(struct ipfw_flow_id *id, int dyn_type, int log_flags,
    char *prefix, char *postfix)
{
	struct in_addr da;
#ifdef INET6
	char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
#else
	char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
#endif

#ifdef INET6
	if (IS_IP6_FLOW_ID(id)) {
		ip6_sprintf(src, &id->src_ip6);
		ip6_sprintf(dst, &id->dst_ip6);
	} else
#endif
	{
		da.s_addr = htonl(id->src_ip);
		inet_ntop(AF_INET, &da, src, sizeof(src));
		da.s_addr = htonl(id->dst_ip);
		inet_ntop(AF_INET, &da, dst, sizeof(dst));
	}
	log(log_flags, "ipfw: %s type %d %s %d -> %s %d, %d %s\n",
	    prefix, dyn_type, src, id->src_port, dst,
	    id->dst_port, DYN_COUNT, postfix);
}

#define	print_dyn_rule(id, dtype, prefix, postfix)	\
	print_dyn_rule_flags(id, dtype, LOG_DEBUG, prefix, postfix)

#define TIME_LEQ(a,b)       ((int)((a)-(b)) <= 0)
#define TIME_LE(a,b)       ((int)((a)-(b)) < 0)

/*
 * Lookup a dynamic rule, locked version.
 */
static ipfw_dyn_rule *
lookup_dyn_rule_locked(struct ipfw_flow_id *pkt, int i, int *match_direction,
    struct tcphdr *tcp)
{
	/*
	 * Stateful ipfw extensions.
	 * Lookup into dynamic session queue.
	 */
#define MATCH_REVERSE	0
#define MATCH_FORWARD	1
#define MATCH_NONE	2
#define MATCH_UNKNOWN	3
	int dir = MATCH_NONE;
	ipfw_dyn_rule *prev, *q = NULL;

	IPFW_BUCK_ASSERT(i);

	for (prev = NULL, q = V_ipfw_dyn_v[i].head; q; prev = q, q = q->next) {
		if (q->dyn_type == O_LIMIT_PARENT && q->count)
			continue;

		if (pkt->proto != q->id.proto || q->dyn_type == O_LIMIT_PARENT)
			continue;

		if (IS_IP6_FLOW_ID(pkt)) {
			if (IN6_ARE_ADDR_EQUAL(&pkt->src_ip6, &q->id.src_ip6) &&
			    IN6_ARE_ADDR_EQUAL(&pkt->dst_ip6, &q->id.dst_ip6) &&
			    pkt->src_port == q->id.src_port &&
			    pkt->dst_port == q->id.dst_port) {
				dir = MATCH_FORWARD;
				break;
			}
			if (IN6_ARE_ADDR_EQUAL(&pkt->src_ip6, &q->id.dst_ip6) &&
			    IN6_ARE_ADDR_EQUAL(&pkt->dst_ip6, &q->id.src_ip6) &&
			    pkt->src_port == q->id.dst_port &&
			    pkt->dst_port == q->id.src_port) {
				dir = MATCH_REVERSE;
				break;
			}
		} else {
			if (pkt->src_ip == q->id.src_ip &&
			    pkt->dst_ip == q->id.dst_ip &&
			    pkt->src_port == q->id.src_port &&
			    pkt->dst_port == q->id.dst_port) {
				dir = MATCH_FORWARD;
				break;
			}
			if (pkt->src_ip == q->id.dst_ip &&
			    pkt->dst_ip == q->id.src_ip &&
			    pkt->src_port == q->id.dst_port &&
			    pkt->dst_port == q->id.src_port) {
				dir = MATCH_REVERSE;
				break;
			}
		}
	}
	if (q == NULL)
		goto done;	/* q = NULL, not found */

	if (prev != NULL) {	/* found and not in front */
		prev->next = q->next;
		q->next = V_ipfw_dyn_v[i].head;
		V_ipfw_dyn_v[i].head = q;
	}
	if (pkt->proto == IPPROTO_TCP) { /* update state according to flags */
		uint32_t ack;
		u_char flags = pkt->_flags & (TH_FIN | TH_SYN | TH_RST);

#define BOTH_SYN	(TH_SYN | (TH_SYN << 8))
#define BOTH_FIN	(TH_FIN | (TH_FIN << 8))
#define	TCP_FLAGS	(TH_FLAGS | (TH_FLAGS << 8))
#define	ACK_FWD		0x10000			/* fwd ack seen */
#define	ACK_REV		0x20000			/* rev ack seen */

		q->state |= (dir == MATCH_FORWARD) ? flags : (flags << 8);
		switch (q->state & TCP_FLAGS) {
		case TH_SYN:			/* opening */
			q->expire = time_uptime + V_dyn_syn_lifetime;
			break;

		case BOTH_SYN:			/* move to established */
		case BOTH_SYN | TH_FIN:		/* one side tries to close */
		case BOTH_SYN | (TH_FIN << 8):
#define _SEQ_GE(a,b) ((int)(a) - (int)(b) >= 0)
			if (tcp == NULL)
				break;

			ack = ntohl(tcp->th_ack);
			if (dir == MATCH_FORWARD) {
				if (q->ack_fwd == 0 ||
				    _SEQ_GE(ack, q->ack_fwd)) {
					q->ack_fwd = ack;
					q->state |= ACK_FWD;
				}
			} else {
				if (q->ack_rev == 0 ||
				    _SEQ_GE(ack, q->ack_rev)) {
					q->ack_rev = ack;
					q->state |= ACK_REV;
				}
			}
			if ((q->state & (ACK_FWD | ACK_REV)) ==
			    (ACK_FWD | ACK_REV)) {
				q->expire = time_uptime + V_dyn_ack_lifetime;
				q->state &= ~(ACK_FWD | ACK_REV);
			}
			break;

		case BOTH_SYN | BOTH_FIN:	/* both sides closed */
			if (V_dyn_fin_lifetime >= V_dyn_keepalive_period)
				V_dyn_fin_lifetime = V_dyn_keepalive_period - 1;
			q->expire = time_uptime + V_dyn_fin_lifetime;
			break;

		default:
#if 0
			/*
			 * reset or some invalid combination, but can also
			 * occur if we use keep-state the wrong way.
			 */
			if ( (q->state & ((TH_RST << 8)|TH_RST)) == 0)
				printf("invalid state: 0x%x\n", q->state);
#endif
			if (V_dyn_rst_lifetime >= V_dyn_keepalive_period)
				V_dyn_rst_lifetime = V_dyn_keepalive_period - 1;
			q->expire = time_uptime + V_dyn_rst_lifetime;
			break;
		}
	} else if (pkt->proto == IPPROTO_UDP) {
		q->expire = time_uptime + V_dyn_udp_lifetime;
	} else {
		/* other protocols */
		q->expire = time_uptime + V_dyn_short_lifetime;
	}
done:
	if (match_direction != NULL)
		*match_direction = dir;
	return (q);
}

ipfw_dyn_rule *
ipfw_lookup_dyn_rule(struct ipfw_flow_id *pkt, int *match_direction,
    struct tcphdr *tcp)
{
	ipfw_dyn_rule *q;
	int i;

	i = hash_packet(pkt, V_curr_dyn_buckets);

	IPFW_BUCK_LOCK(i);
	q = lookup_dyn_rule_locked(pkt, i, match_direction, tcp);
	if (q == NULL)
		IPFW_BUCK_UNLOCK(i);
	/* NB: return table locked when q is not NULL */
	return q;
}

/*
 * Unlock bucket mtx
 * @p - pointer to dynamic rule
 */
void
ipfw_dyn_unlock(ipfw_dyn_rule *q)
{

	IPFW_BUCK_UNLOCK(q->bucket);
}

static int
resize_dynamic_table(struct ip_fw_chain *chain, int nbuckets)
{
	int i, k, nbuckets_old;
	ipfw_dyn_rule *q;
	struct ipfw_dyn_bucket *dyn_v, *dyn_v_old;

	/* Check if given number is power of 2 and less than 64k */
	if ((nbuckets > 65536) || (!powerof2(nbuckets)))
		return 1;

	CTR3(KTR_NET, "%s: resize dynamic hash: %d -> %d", __func__,
	    V_curr_dyn_buckets, nbuckets);

	/* Allocate and initialize new hash */
	dyn_v = malloc(nbuckets * sizeof(ipfw_dyn_rule), M_IPFW,
	    M_WAITOK | M_ZERO);

	for (i = 0 ; i < nbuckets; i++)
		IPFW_BUCK_LOCK_INIT(&dyn_v[i]);

	/*
	 * Call upper half lock, as get_map() do to ease
	 * read-only access to dynamic rules hash from sysctl
	 */
	IPFW_UH_WLOCK(chain);

	/*
	 * Acquire chain write lock to permit hash access
	 * for main traffic path without additional locks
	 */
	IPFW_WLOCK(chain);

	/* Save old values */
	nbuckets_old = V_curr_dyn_buckets;
	dyn_v_old = V_ipfw_dyn_v;

	/* Skip relinking if array is not set up */
	if (V_ipfw_dyn_v == NULL)
		V_curr_dyn_buckets = 0;

	/* Re-link all dynamic states */
	for (i = 0 ; i < V_curr_dyn_buckets ; i++) {
		while (V_ipfw_dyn_v[i].head != NULL) {
			/* Remove from current chain */
			q = V_ipfw_dyn_v[i].head;
			V_ipfw_dyn_v[i].head = q->next;

			/* Get new hash value */
			k = hash_packet(&q->id, nbuckets);
			q->bucket = k;
			/* Add to the new head */
			q->next = dyn_v[k].head;
			dyn_v[k].head = q;
             }
	}

	/* Update current pointers/buckets values */
	V_curr_dyn_buckets = nbuckets;
	V_ipfw_dyn_v = dyn_v;

	IPFW_WUNLOCK(chain);

	IPFW_UH_WUNLOCK(chain);

	/* Start periodic callout on initial creation */
	if (dyn_v_old == NULL) {
        	callout_reset_on(&V_ipfw_timeout, hz, ipfw_dyn_tick, curvnet, 0);
		return (0);
	}

	/* Destroy all mutexes */
	for (i = 0 ; i < nbuckets_old ; i++)
		IPFW_BUCK_LOCK_DESTROY(&dyn_v_old[i]);

	/* Free old hash */
	free(dyn_v_old, M_IPFW);

	return 0;
}

/**
 * Install state of type 'type' for a dynamic session.
 * The hash table contains two type of rules:
 * - regular rules (O_KEEP_STATE)
 * - rules for sessions with limited number of sess per user
 *   (O_LIMIT). When they are created, the parent is
 *   increased by 1, and decreased on delete. In this case,
 *   the third parameter is the parent rule and not the chain.
 * - "parent" rules for the above (O_LIMIT_PARENT).
 */
static ipfw_dyn_rule *
add_dyn_rule(struct ipfw_flow_id *id, int i, u_int8_t dyn_type, struct ip_fw *rule)
{
	ipfw_dyn_rule *r;

	IPFW_BUCK_ASSERT(i);

	r = uma_zalloc(V_ipfw_dyn_rule_zone, M_NOWAIT | M_ZERO);
	if (r == NULL) {
		if (last_log != time_uptime) {
			last_log = time_uptime;
			log(LOG_DEBUG, "ipfw: %s: Cannot allocate rule\n",
			    __func__);
		}
		return NULL;
	}
	ipfw_dyn_count++;

	/*
	 * refcount on parent is already incremented, so
	 * it is safe to use parent unlocked.
	 */
	if (dyn_type == O_LIMIT) {
		ipfw_dyn_rule *parent = (ipfw_dyn_rule *)rule;
		if ( parent->dyn_type != O_LIMIT_PARENT)
			panic("invalid parent");
		r->parent = parent;
		rule = parent->rule;
	}

	r->id = *id;
	r->expire = time_uptime + V_dyn_syn_lifetime;
	r->rule = rule;
	r->dyn_type = dyn_type;
	IPFW_ZERO_DYN_COUNTER(r);
	r->count = 0;

	r->bucket = i;
	r->next = V_ipfw_dyn_v[i].head;
	V_ipfw_dyn_v[i].head = r;
	DEB(print_dyn_rule(id, dyn_type, "add dyn entry", "total");)
	return r;
}

/**
 * lookup dynamic parent rule using pkt and rule as search keys.
 * If the lookup fails, then install one.
 */
static ipfw_dyn_rule *
lookup_dyn_parent(struct ipfw_flow_id *pkt, int *pindex, struct ip_fw *rule)
{
	ipfw_dyn_rule *q;
	int i, is_v6;

	is_v6 = IS_IP6_FLOW_ID(pkt);
	i = hash_packet( pkt, V_curr_dyn_buckets );
	*pindex = i;
	IPFW_BUCK_LOCK(i);
	for (q = V_ipfw_dyn_v[i].head ; q != NULL ; q=q->next)
		if (q->dyn_type == O_LIMIT_PARENT &&
		    rule== q->rule &&
		    pkt->proto == q->id.proto &&
		    pkt->src_port == q->id.src_port &&
		    pkt->dst_port == q->id.dst_port &&
		    (
			(is_v6 &&
			 IN6_ARE_ADDR_EQUAL(&(pkt->src_ip6),
				&(q->id.src_ip6)) &&
			 IN6_ARE_ADDR_EQUAL(&(pkt->dst_ip6),
				&(q->id.dst_ip6))) ||
			(!is_v6 &&
			 pkt->src_ip == q->id.src_ip &&
			 pkt->dst_ip == q->id.dst_ip)
		    )
		) {
			q->expire = time_uptime + V_dyn_short_lifetime;
			DEB(print_dyn_rule(pkt, q->dyn_type,
			    "lookup_dyn_parent found", "");)
			return q;
		}

	/* Add virtual limiting rule */
	return add_dyn_rule(pkt, i, O_LIMIT_PARENT, rule);
}

/**
 * Install dynamic state for rule type cmd->o.opcode
 *
 * Returns 1 (failure) if state is not installed because of errors or because
 * session limitations are enforced.
 */
int
ipfw_install_state(struct ip_fw *rule, ipfw_insn_limit *cmd,
    struct ip_fw_args *args, uint32_t tablearg)
{
	ipfw_dyn_rule *q;
	int i;

	DEB(print_dyn_rule(&args->f_id, cmd->o.opcode, "install_state", "");)

	i = hash_packet(&args->f_id, V_curr_dyn_buckets);

	IPFW_BUCK_LOCK(i);

	q = lookup_dyn_rule_locked(&args->f_id, i, NULL, NULL);

	if (q != NULL) {	/* should never occur */
		DEB(
		if (last_log != time_uptime) {
			last_log = time_uptime;
			printf("ipfw: %s: entry already present, done\n",
			    __func__);
		})
		IPFW_BUCK_UNLOCK(i);
		return (0);
	}

	/*
	 * State limiting is done via uma(9) zone limiting.
	 * Save pointer to newly-installed rule and reject
	 * packet if add_dyn_rule() returned NULL.
	 * Note q is currently set to NULL.
	 */

	switch (cmd->o.opcode) {
	case O_KEEP_STATE:	/* bidir rule */
		q = add_dyn_rule(&args->f_id, i, O_KEEP_STATE, rule);
		break;

	case O_LIMIT: {		/* limit number of sessions */
		struct ipfw_flow_id id;
		ipfw_dyn_rule *parent;
		uint32_t conn_limit;
		uint16_t limit_mask = cmd->limit_mask;
		int pindex;

		conn_limit = IP_FW_ARG_TABLEARG(cmd->conn_limit);

		DEB(
		if (cmd->conn_limit == IP_FW_TABLEARG)
			printf("ipfw: %s: O_LIMIT rule, conn_limit: %u "
			    "(tablearg)\n", __func__, conn_limit);
		else
			printf("ipfw: %s: O_LIMIT rule, conn_limit: %u\n",
			    __func__, conn_limit);
		)

		id.dst_ip = id.src_ip = id.dst_port = id.src_port = 0;
		id.proto = args->f_id.proto;
		id.addr_type = args->f_id.addr_type;
		id.fib = M_GETFIB(args->m);

		if (IS_IP6_FLOW_ID (&(args->f_id))) {
			if (limit_mask & DYN_SRC_ADDR)
				id.src_ip6 = args->f_id.src_ip6;
			if (limit_mask & DYN_DST_ADDR)
				id.dst_ip6 = args->f_id.dst_ip6;
		} else {
			if (limit_mask & DYN_SRC_ADDR)
				id.src_ip = args->f_id.src_ip;
			if (limit_mask & DYN_DST_ADDR)
				id.dst_ip = args->f_id.dst_ip;
		}
		if (limit_mask & DYN_SRC_PORT)
			id.src_port = args->f_id.src_port;
		if (limit_mask & DYN_DST_PORT)
			id.dst_port = args->f_id.dst_port;

		/*
		 * We have to release lock for previous bucket to
		 * avoid possible deadlock
		 */
		IPFW_BUCK_UNLOCK(i);

		if ((parent = lookup_dyn_parent(&id, &pindex, rule)) == NULL) {
			printf("ipfw: %s: add parent failed\n", __func__);
			IPFW_BUCK_UNLOCK(pindex);
			return (1);
		}

		if (parent->count >= conn_limit) {
			if (V_fw_verbose && last_log != time_uptime) {
				last_log = time_uptime;
				char sbuf[24];
				last_log = time_uptime;
				snprintf(sbuf, sizeof(sbuf),
				    "%d drop session",
				    parent->rule->rulenum);
				print_dyn_rule_flags(&args->f_id,
				    cmd->o.opcode,
				    LOG_SECURITY | LOG_DEBUG,
				    sbuf, "too many entries");
			}
			IPFW_BUCK_UNLOCK(pindex);
			return (1);
		}
		/* Increment counter on parent */
		parent->count++;
		IPFW_BUCK_UNLOCK(pindex);

		IPFW_BUCK_LOCK(i);
		q = add_dyn_rule(&args->f_id, i, O_LIMIT, (struct ip_fw *)parent);
		if (q == NULL) {
			/* Decrement index and notify caller */
			IPFW_BUCK_UNLOCK(i);
			IPFW_BUCK_LOCK(pindex);
			parent->count--;
			IPFW_BUCK_UNLOCK(pindex);
			return (1);
		}
		break;
	}
	default:
		printf("ipfw: %s: unknown dynamic rule type %u\n",
		    __func__, cmd->o.opcode);
	}

	if (q == NULL) {
		IPFW_BUCK_UNLOCK(i);
		return (1);	/* Notify caller about failure */
	}

	/* XXX just set lifetime */
	lookup_dyn_rule_locked(&args->f_id, i, NULL, NULL);

	IPFW_BUCK_UNLOCK(i);
	return (0);
}

/*
 * Generate a TCP packet, containing either a RST or a keepalive.
 * When flags & TH_RST, we are sending a RST packet, because of a
 * "reset" action matched the packet.
 * Otherwise we are sending a keepalive, and flags & TH_
 * The 'replyto' mbuf is the mbuf being replied to, if any, and is required
 * so that MAC can label the reply appropriately.
 */
struct mbuf *
ipfw_send_pkt(struct mbuf *replyto, struct ipfw_flow_id *id, u_int32_t seq,
    u_int32_t ack, int flags)
{
	struct mbuf *m = NULL;		/* stupid compiler */
	int len, dir;
	struct ip *h = NULL;		/* stupid compiler */
#ifdef INET6
	struct ip6_hdr *h6 = NULL;
#endif
	struct tcphdr *th = NULL;

	MGETHDR(m, M_NOWAIT, MT_DATA);
	if (m == NULL)
		return (NULL);

	M_SETFIB(m, id->fib);
#ifdef MAC
	if (replyto != NULL)
		mac_netinet_firewall_reply(replyto, m);
	else
		mac_netinet_firewall_send(m);
#else
	(void)replyto;		/* don't warn about unused arg */
#endif

	switch (id->addr_type) {
	case 4:
		len = sizeof(struct ip) + sizeof(struct tcphdr);
		break;
#ifdef INET6
	case 6:
		len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
		break;
#endif
	default:
		/* XXX: log me?!? */
		FREE_PKT(m);
		return (NULL);
	}
	dir = ((flags & (TH_SYN | TH_RST)) == TH_SYN);

	m->m_data += max_linkhdr;
	m->m_flags |= M_SKIP_FIREWALL;
	m->m_pkthdr.len = m->m_len = len;
	m->m_pkthdr.rcvif = NULL;
	bzero(m->m_data, len);

	switch (id->addr_type) {
	case 4:
		h = mtod(m, struct ip *);

		/* prepare for checksum */
		h->ip_p = IPPROTO_TCP;
		h->ip_len = htons(sizeof(struct tcphdr));
		if (dir) {
			h->ip_src.s_addr = htonl(id->src_ip);
			h->ip_dst.s_addr = htonl(id->dst_ip);
		} else {
			h->ip_src.s_addr = htonl(id->dst_ip);
			h->ip_dst.s_addr = htonl(id->src_ip);
		}

		th = (struct tcphdr *)(h + 1);
		break;
#ifdef INET6
	case 6:
		h6 = mtod(m, struct ip6_hdr *);

		/* prepare for checksum */
		h6->ip6_nxt = IPPROTO_TCP;
		h6->ip6_plen = htons(sizeof(struct tcphdr));
		if (dir) {
			h6->ip6_src = id->src_ip6;
			h6->ip6_dst = id->dst_ip6;
		} else {
			h6->ip6_src = id->dst_ip6;
			h6->ip6_dst = id->src_ip6;
		}

		th = (struct tcphdr *)(h6 + 1);
		break;
#endif
	}

	if (dir) {
		th->th_sport = htons(id->src_port);
		th->th_dport = htons(id->dst_port);
	} else {
		th->th_sport = htons(id->dst_port);
		th->th_dport = htons(id->src_port);
	}
	th->th_off = sizeof(struct tcphdr) >> 2;

	if (flags & TH_RST) {
		if (flags & TH_ACK) {
			th->th_seq = htonl(ack);
			th->th_flags = TH_RST;
		} else {
			if (flags & TH_SYN)
				seq++;
			th->th_ack = htonl(seq);
			th->th_flags = TH_RST | TH_ACK;
		}
	} else {
		/*
		 * Keepalive - use caller provided sequence numbers
		 */
		th->th_seq = htonl(seq);
		th->th_ack = htonl(ack);
		th->th_flags = TH_ACK;
	}

	switch (id->addr_type) {
	case 4:
		th->th_sum = in_cksum(m, len);

		/* finish the ip header */
		h->ip_v = 4;
		h->ip_hl = sizeof(*h) >> 2;
		h->ip_tos = IPTOS_LOWDELAY;
		h->ip_off = htons(0);
		h->ip_len = htons(len);
		h->ip_ttl = V_ip_defttl;
		h->ip_sum = 0;
		break;
#ifdef INET6
	case 6:
		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(*h6),
		    sizeof(struct tcphdr));

		/* finish the ip6 header */
		h6->ip6_vfc |= IPV6_VERSION;
		h6->ip6_hlim = IPV6_DEFHLIM;
		break;
#endif
	}

	return (m);
}

/*
 * Queue keepalive packets for given dynamic rule
 */
static struct mbuf **
ipfw_dyn_send_ka(struct mbuf **mtailp, ipfw_dyn_rule *q)
{
	struct mbuf *m_rev, *m_fwd;

	m_rev = (q->state & ACK_REV) ? NULL :
	    ipfw_send_pkt(NULL, &(q->id), q->ack_rev - 1, q->ack_fwd, TH_SYN);
	m_fwd = (q->state & ACK_FWD) ? NULL :
	    ipfw_send_pkt(NULL, &(q->id), q->ack_fwd - 1, q->ack_rev, 0);

	if (m_rev != NULL) {
		*mtailp = m_rev;
		mtailp = &(*mtailp)->m_nextpkt;
	}
	if (m_fwd != NULL) {
		*mtailp = m_fwd;
		mtailp = &(*mtailp)->m_nextpkt;
	}

	return (mtailp);
}

/*
 * This procedure is used to perform various maintance
 * on dynamic hash list. Currently it is called every second.
 */
static void
ipfw_dyn_tick(void * vnetx)
{
	struct ip_fw_chain *chain;
	int check_ka = 0;
#ifdef VIMAGE
	struct vnet *vp = vnetx;
#endif

	CURVNET_SET(vp);

	chain = &V_layer3_chain;

	/* Run keepalive checks every keepalive_period iff ka is enabled */
	if ((V_dyn_keepalive_last + V_dyn_keepalive_period <= time_uptime) &&
	    (V_dyn_keepalive != 0)) {
		V_dyn_keepalive_last = time_uptime;
		check_ka = 1;
	}

	check_dyn_rules(chain, NULL, RESVD_SET, check_ka, 1);

	callout_reset_on(&V_ipfw_timeout, hz, ipfw_dyn_tick, vnetx, 0);

	CURVNET_RESTORE();
}

/*
 * Walk thru all dynamic states doing generic maintance:
 * 1) free expired states
 * 2) free all states based on deleted rule / set
 * 3) send keepalives for states if needed
 *
 * @chain - pointer to current ipfw rules chain
 * @rule - delete all states originated by given rule if != NULL
 * @set - delete all states originated by any rule in set @set if != RESVD_SET
 * @check_ka - perform checking/sending keepalives
 * @timer - indicate call from timer routine.
 *
 * Timer routine must call this function unlocked to permit
 * sending keepalives/resizing table.
 *
 * Others has to call function with IPFW_UH_WLOCK held.
 * Additionally, function assume that dynamic rule/set is
 * ALREADY deleted so no new states can be generated by
 * 'deleted' rules.
 *
 * Write lock is needed to ensure that unused parent rules
 * are not freed by other instance (see stage 2, 3)
 */
static void
check_dyn_rules(struct ip_fw_chain *chain, struct ip_fw *rule,
    int set, int check_ka, int timer)
{
	struct mbuf *m0, *m, *mnext, **mtailp;
	struct ip *h;
	int i, dyn_count, new_buckets = 0, max_buckets;
	int expired = 0, expired_limits = 0, parents = 0, total = 0;
	ipfw_dyn_rule *q, *q_prev, *q_next;
	ipfw_dyn_rule *exp_head, **exptailp;
	ipfw_dyn_rule *exp_lhead, **expltailp;

	KASSERT(V_ipfw_dyn_v != NULL, ("%s: dynamic table not allocated",
	    __func__));

	/* Avoid possible LOR */
	KASSERT(!check_ka || timer, ("%s: keepalive check with lock held",
	    __func__));

	/*
	 * Do not perform any checks if we currently have no dynamic states
	 */
	if (DYN_COUNT == 0)
		return;

	/* Expired states */
	exp_head = NULL;
	exptailp = &exp_head;

	/* Expired limit states */
	exp_lhead = NULL;
	expltailp = &exp_lhead;

	/*
	 * We make a chain of packets to go out here -- not deferring
	 * until after we drop the IPFW dynamic rule lock would result
	 * in a lock order reversal with the normal packet input -> ipfw
	 * call stack.
	 */
	m0 = NULL;
	mtailp = &m0;

	/* Protect from hash resizing */
	if (timer != 0)
		IPFW_UH_WLOCK(chain);
	else
		IPFW_UH_WLOCK_ASSERT(chain);

#define	NEXT_RULE()	{ q_prev = q; q = q->next ; continue; }

	/* Stage 1: perform requested deletion */
	for (i = 0 ; i < V_curr_dyn_buckets ; i++) {
		IPFW_BUCK_LOCK(i);
		for (q = V_ipfw_dyn_v[i].head, q_prev = q; q ; ) {
			/* account every rule */
			total++;

			/* Skip parent rules at all */
			if (q->dyn_type == O_LIMIT_PARENT) {
				parents++;
				NEXT_RULE();
			}

			/*
			 * Remove rules which are:
			 * 1) expired
			 * 2) created by given rule
			 * 3) created by any rule in given set
			 */
			if ((TIME_LEQ(q->expire, time_uptime)) ||
			    ((rule != NULL) && (q->rule == rule)) ||
			    ((set != RESVD_SET) && (q->rule->set == set))) {
				if (TIME_LE(time_uptime, q->expire) &&
				    q->dyn_type == O_KEEP_STATE &&
				    V_dyn_keep_states != 0) {
					/*
					 * Do not delete state if
					 * it is not expired and
					 * dyn_keep_states is ON.
					 * However we need to re-link it
					 * to any other stable rule
					 */
					q->rule = chain->default_rule;
					NEXT_RULE();
				}

				/* Unlink q from current list */
				q_next = q->next;
				if (q == V_ipfw_dyn_v[i].head)
					V_ipfw_dyn_v[i].head = q_next;
				else
					q_prev->next = q_next;

				q->next = NULL;

				/* queue q to expire list */
				if (q->dyn_type != O_LIMIT) {
					*exptailp = q;
					exptailp = &(*exptailp)->next;
					DEB(print_dyn_rule(&q->id, q->dyn_type,
					    "unlink entry", "left");
					)
				} else {
					/* Separate list for limit rules */
					*expltailp = q;
					expltailp = &(*expltailp)->next;
					expired_limits++;
					DEB(print_dyn_rule(&q->id, q->dyn_type,
					    "unlink limit entry", "left");
					)
				}

				q = q_next;
				expired++;
				continue;
			}

			/*
			 * Check if we need to send keepalive:
			 * we need to ensure if is time to do KA,
			 * this is established TCP session, and
			 * expire time is within keepalive interval
			 */
			if ((check_ka != 0) && (q->id.proto == IPPROTO_TCP) &&
			    ((q->state & BOTH_SYN) == BOTH_SYN) &&
			    (TIME_LEQ(q->expire, time_uptime +
			      V_dyn_keepalive_interval)))
				mtailp = ipfw_dyn_send_ka(mtailp, q);

			NEXT_RULE();
		}
		IPFW_BUCK_UNLOCK(i);
	}

	/* Stage 2: decrement counters from O_LIMIT parents */
	if (expired_limits != 0) {
		/*
		 * XXX: Note that deleting set with more than one
		 * heavily-used LIMIT rules can result in overwhelming
		 * locking due to lack of per-hash value sorting
		 *
		 * We should probably think about:
		 * 1) pre-allocating hash of size, say,
		 * MAX(16, V_curr_dyn_buckets / 1024)
		 * 2) checking if expired_limits is large enough
		 * 3) If yes, init hash (or its part), re-link
		 * current list and start decrementing procedure in
		 * each bucket separately
		 */

		/*
		 * Small optimization: do not unlock bucket until
		 * we see the next item resides in different bucket
		 */
		if (exp_lhead != NULL) {
			i = exp_lhead->parent->bucket;
			IPFW_BUCK_LOCK(i);
		}
		for (q = exp_lhead; q != NULL; q = q->next) {
			if (i != q->parent->bucket) {
				IPFW_BUCK_UNLOCK(i);
				i = q->parent->bucket;
				IPFW_BUCK_LOCK(i);
			}

			/* Decrease parent refcount */
			q->parent->count--;
		}
		if (exp_lhead != NULL)
			IPFW_BUCK_UNLOCK(i);
	}

	/*
	 * We protectet ourselves from unused parent deletion
	 * (from the timer function) by holding UH write lock.
	 */

	/* Stage 3: remove unused parent rules */
	if ((parents != 0) && (expired != 0)) {
		for (i = 0 ; i < V_curr_dyn_buckets ; i++) {
			IPFW_BUCK_LOCK(i);
			for (q = V_ipfw_dyn_v[i].head, q_prev = q ; q ; ) {
				if (q->dyn_type != O_LIMIT_PARENT)
					NEXT_RULE();

				if (q->count != 0)
					NEXT_RULE();

				/* Parent rule without consumers */

				/* Unlink q from current list */
				q_next = q->next;
				if (q == V_ipfw_dyn_v[i].head)
					V_ipfw_dyn_v[i].head = q_next;
				else
					q_prev->next = q_next;

				q->next = NULL;

				/* Add to expired list */
				*exptailp = q;
				exptailp = &(*exptailp)->next;

				DEB(print_dyn_rule(&q->id, q->dyn_type,
				    "unlink parent entry", "left");
				)

				expired++;

				q = q_next;
			}
			IPFW_BUCK_UNLOCK(i);
		}
	}

#undef NEXT_RULE

	if (timer != 0) {
		/*
		 * Check if we need to resize hash:
		 * if current number of states exceeds number of buckes in hash,
		 * grow hash size to the minimum power of 2 which is bigger than
		 * current states count. Limit hash size by 64k.
		 */
		max_buckets = (V_dyn_buckets_max > 65536) ?
		    65536 : V_dyn_buckets_max;

		dyn_count = DYN_COUNT;

		if ((dyn_count > V_curr_dyn_buckets * 2) &&
		    (dyn_count < max_buckets)) {
			new_buckets = V_curr_dyn_buckets;
			while (new_buckets < dyn_count) {
				new_buckets *= 2;

				if (new_buckets >= max_buckets)
					break;
			}
		}

		IPFW_UH_WUNLOCK(chain);
	}

	/* Finally delete old states ad limits if any */
	for (q = exp_head; q != NULL; q = q_next) {
		q_next = q->next;
		uma_zfree(V_ipfw_dyn_rule_zone, q);
		ipfw_dyn_count--;
	}

	for (q = exp_lhead; q != NULL; q = q_next) {
		q_next = q->next;
		uma_zfree(V_ipfw_dyn_rule_zone, q);
		ipfw_dyn_count--;
	}

	/*
	 * The rest code MUST be called from timer routine only
	 * without holding any locks
	 */
	if (timer == 0)
		return;

	/* Send keepalive packets if any */
	for (m = m0; m != NULL; m = mnext) {
		mnext = m->m_nextpkt;
		m->m_nextpkt = NULL;
		h = mtod(m, struct ip *);
		if (h->ip_v == 4)
			ip_output(m, NULL, NULL, 0, NULL, NULL);
#ifdef INET6
		else
			ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
#endif
	}

	/* Run table resize without holding any locks */
	if (new_buckets != 0)
		resize_dynamic_table(chain, new_buckets);
}

/*
 * Deletes all dynamic rules originated by given rule or all rules in
 * given set. Specify RESVD_SET to indicate set should not be used.
 * @chain - pointer to current ipfw rules chain
 * @rule - delete all states originated by given rule if != NULL
 * @set - delete all states originated by any rule in set @set if != RESVD_SET
 *
 * Function has to be called with IPFW_UH_WLOCK held.
 * Additionally, function assume that dynamic rule/set is
 * ALREADY deleted so no new states can be generated by
 * 'deleted' rules.
 */
void
ipfw_expire_dyn_rules(struct ip_fw_chain *chain, struct ip_fw *rule, int set)
{

	check_dyn_rules(chain, rule, set, 0, 0);
}

void
ipfw_dyn_init(struct ip_fw_chain *chain)
{

        V_ipfw_dyn_v = NULL;
        V_dyn_buckets_max = 256; /* must be power of 2 */
        V_curr_dyn_buckets = 256; /* must be power of 2 */

        V_dyn_ack_lifetime = 300;
        V_dyn_syn_lifetime = 20;
        V_dyn_fin_lifetime = 1;
        V_dyn_rst_lifetime = 1;
        V_dyn_udp_lifetime = 10;
        V_dyn_short_lifetime = 5;

        V_dyn_keepalive_interval = 20;
        V_dyn_keepalive_period = 5;
        V_dyn_keepalive = 1;    /* do send keepalives */
	V_dyn_keepalive_last = time_uptime;

        V_dyn_max = 4096;       /* max # of dynamic rules */

	V_ipfw_dyn_rule_zone = uma_zcreate("IPFW dynamic rule",
	    sizeof(ipfw_dyn_rule), NULL, NULL, NULL, NULL,
	    UMA_ALIGN_PTR, 0);

	/* Enforce limit on dynamic rules */
	uma_zone_set_max(V_ipfw_dyn_rule_zone, V_dyn_max);

        callout_init(&V_ipfw_timeout, CALLOUT_MPSAFE);

	/*
	 * This can potentially be done on first dynamic rule
	 * being added to chain.
	 */
	resize_dynamic_table(chain, V_curr_dyn_buckets);
}

void
ipfw_dyn_uninit(int pass)
{
	int i;

	if (pass == 0) {
		callout_drain(&V_ipfw_timeout);
		return;
	}

	if (V_ipfw_dyn_v != NULL) {
		/*
		 * Skip deleting all dynamic states -
		 * uma_zdestroy() does this more efficiently;
		 */

		/* Destroy all mutexes */
		for (i = 0 ; i < V_curr_dyn_buckets ; i++)
			IPFW_BUCK_LOCK_DESTROY(&V_ipfw_dyn_v[i]);
		free(V_ipfw_dyn_v, M_IPFW);
		V_ipfw_dyn_v = NULL;
	}

        uma_zdestroy(V_ipfw_dyn_rule_zone);
}

#ifdef SYSCTL_NODE
/*
 * Get/set maximum number of dynamic states in given VNET instance.
 */
static int
sysctl_ipfw_dyn_max(SYSCTL_HANDLER_ARGS)
{
	int error;
	unsigned int nstates;

	nstates = V_dyn_max;

	error = sysctl_handle_int(oidp, &nstates, 0, req);
	/* Read operation or some error */
	if ((error != 0) || (req->newptr == NULL))
		return (error);

	V_dyn_max = nstates;
	uma_zone_set_max(V_ipfw_dyn_rule_zone, V_dyn_max);

	return (0);
}

/*
 * Get current number of dynamic states in given VNET instance.
 */
static int
sysctl_ipfw_dyn_count(SYSCTL_HANDLER_ARGS)
{
	int error;
	unsigned int nstates;

	nstates = DYN_COUNT;

	error = sysctl_handle_int(oidp, &nstates, 0, req);

	return (error);
}
#endif

/*
 * Returns number of dynamic rules.
 */
int
ipfw_dyn_len(void)
{

	return (V_ipfw_dyn_v == NULL) ? 0 :
		(DYN_COUNT * sizeof(ipfw_dyn_rule));
}

/*
 * Fill given buffer with dynamic states.
 * IPFW_UH_RLOCK has to be held while calling.
 */
void
ipfw_get_dynamic(struct ip_fw_chain *chain, char **pbp, const char *ep)
{
	ipfw_dyn_rule *p, *last = NULL;
	char *bp;
	int i;

	if (V_ipfw_dyn_v == NULL)
		return;
	bp = *pbp;

	IPFW_UH_RLOCK_ASSERT(chain);

	for (i = 0 ; i < V_curr_dyn_buckets; i++) {
		IPFW_BUCK_LOCK(i);
		for (p = V_ipfw_dyn_v[i].head ; p != NULL; p = p->next) {
			if (bp + sizeof *p <= ep) {
				ipfw_dyn_rule *dst =
					(ipfw_dyn_rule *)bp;
				bcopy(p, dst, sizeof *p);
				bcopy(&(p->rule->rulenum), &(dst->rule),
				    sizeof(p->rule->rulenum));
				/*
				 * store set number into high word of
				 * dst->rule pointer.
				 */
				bcopy(&(p->rule->set),
				    (char *)&dst->rule +
				    sizeof(p->rule->rulenum),
				    sizeof(p->rule->set));
				/*
				 * store a non-null value in "next".
				 * The userland code will interpret a
				 * NULL here as a marker
				 * for the last dynamic rule.
				 */
				bcopy(&dst, &dst->next, sizeof(dst));
				last = dst;
				dst->expire =
				    TIME_LEQ(dst->expire, time_uptime) ?
					0 : dst->expire - time_uptime ;
				bp += sizeof(ipfw_dyn_rule);
			}
		}
		IPFW_BUCK_UNLOCK(i);
	}

	if (last != NULL) /* mark last dynamic rule */
		bzero(&last->next, sizeof(last));
	*pbp = bp;
}
/* end of file */

redpajama_set_name: RedPajamaGithub


Well, wasn't I stunned when I received a sweet note from Jess at Little Girl Story. She very kindly nominated me for The Lovely Blog Award. What a Sweetie she is and I thank her so much for the honor.
Nominate 7 or so bloggers you admire.
Gramps and I will be married 45 years the end of this month. That number seems so enormous to me and yet . . .. It is such an odd feeling being with one person for a huge portion of my life and still putting forth effort every day to be a good wife, companion, home provider, confidant and advisor.
I eat American cheese with my apple pie, just like my Daddy did.
I love amusement parks! However, Gramps and I are not compatible riders. He likes up and down, i.e. roller coasters and I like around and around, i.e. Tilt-a-Whirls.
I was secretly addicted to "The Real Housewives of NYC" and watched every episode. I don't know why, but I was fascinated.
I once had a white rabbit named Hutch and a black cat named Starsky. The vet thought it was pretty funny!
My favorite color is blue. I live in a predominately blue and white world, to which my family will attest. If only dirt came in blue . . . my life would be so much easier.
I started my blog two years ago to share all my feelings about being the matriarch, the oldest female of my family. I wanted to inspire, validate and uplift other women in my same situation in life. I also hoped to speak to younger mothers with a message of hope, that aging is to be embraced and not feared.
I adore being a grandmother. I feel that everything I have done and learned in my life has prepared me for this unique job of grannyhood. And it is a job! I'm sure many people think that when they reach a certain age (you know when you get there!), they should just sit back in the rocking chair, wait for room service and watch the world pass by.
I believe just the opposite. Well-seasoned people should be living, vibrant examples of all they have learned and experienced. They are the teachers and leaders of the family. They are the advisors, the historians, the confidants. Who else can connect all the generations, tell the stories and teach the lessons of life? No one else has the wisdom and experience except the elders.
Becoming an elder and grandmother has been very fulfilling. I can see my family circle becoming stronger because of each person. From the youngest (age 4 years), to the oldest, me.
I don't really think of myself as a writer . . . more of a storyteller. Hope you enjoy the stories I have to tell, the pictures I try to paint with words, and the feelings I hope to convey. Feel free to share your comments and responses. I would love to hear from all of you.
Check out these blogs. I love them and I think you will too.
This entry was posted in In the Village and tagged family, Gramps, Granny, gratitude, life, lovely award by The Village Granny. Bookmark the permalink.
Hi Village Granny, you are so sweet. The 7 things I dont know about you makes me SMILE 🙂 especially No. 3 & 4. Make sure you don't miss any episodes of "The Real Housewives of NYC" .
Thank you Sweetie. You make me smile too.
I am so happy for you, congratulations. I think that is one big thing we have in common, we both consider ourselves storytellers.
I too think that as people live life they become more seasoned. And Granny, oh my, how sweet and wonderfully you are seasoned. Good and healing thoughts to you.
Thank you Sweetie! I feel well-seasoned. In fact, I feel down right done on some days! But I'm loving the journey. I do love having things in common with you.


Surround yourself in natural beauty, connect with imposing mountains and volcanoes, enjoy pure, fresh breezes and truly magnificent views in the snow-capped Andes which grace the length of Chile.
A dazzling white world to delight your senses and get your pulse racing! Winter offers a feast of new experiences among these snowy peaks and densely wooded valleys. Enjoy incredible skiing, snowboarding and sledging on slopes and ramps to suit all levels. Experience the thrill of a night-time descent on magical torch-lit tracks. And at the end of each jam-packed day of energetic fun, bubbling hot springs and delicious food await you.
Welcome to Chile's superb winter resorts, located at over 2,000 meters above sea level and boasting the best ski slopes in South America. You'll find some of the more cosmopolitan resorts just a few kilometers outside Santiago, offering outstanding on and off-piste skiing and first-rate services and amenities.
Further south, the options for adventure are almost limitless. Ski resorts located right at the heart of the Conguillío, Malalcahuello, Villarrica and Puyehue National Parks enable you to ski over a vast area. Or snowboard – if you dare – on the flanks of a live volcano! Hop on a snowmobile for an exhilarating cross-country ride, or heli-ski and snow surf on pristine, high-altitude snowfields. All this and much more awaits you. Unleash your spirit of adventure in Chile!


In 2008, the US economy went under in what is now known as the Great Recession. Stocks were down, unemployment rate was up and foreclosures were at a peak. This market crash was a stepping stone for a small percentage of the population, the real estate investors.
While leveraging lower property values and foreclosure auctions, many hedge funds, developers, investment firms and private companies used this opportunity to gain a place in the real estate market and rebuild the economy.
Today, there are communities in every urban metro in the US that is experiencing gentrification due to the influx of these investors in recent years. Gentrification is the newest socioeconomic disparity in America.
Neighborhoods that were once affordable to blue-collar working class families, are now attracting wealthy middle class homeowners.
Neighborhoods that were once notorious for violent crimes, are now chartered as historic and renamed to appeal the young hip residents.
Neighborhoods that were once overlooked in city's budget plans, are now provided a weekly farmers market.
These new communities have pushed out some of the old residents with the increase in tax values, increase in rent, and neighborhood land development. Other residents have fought to keep their property in hopes of retaining some of the neighborhoods culture. However, what most people do not realize is that some neighbors they are fighting against were in fact the original residents of these communities.
Prior to the Great Depression, in the 1930's the federal housing agency played a role in redlining inner city neighborhoods which resulted in mass number of whites moving to suburban areas in order to qualify for home loans. According to data from the National Community Reinvestment Coalition the affluent white middle class moved out of the inner city and the minority population were denied home loans and pushed into these urban metro areas.
Eventually in the 1960s and 1970s factories moved out of the inner cities and closer to areas where white communities were. This caused spikes in unemployment rates for blacks who were not able to get to work in the suburbs. In turn, the inner city communities took a huge decline. The public housing communities that were built to house poor minorities were not being reinvested into. The buildings were falling apart, drugs were infiltrated, and crime was unstoppable.
In the 1990s, President Clinton signed two bills into law that would be the beginning of reforming inner cities back to what they were originally, neighborhoods for affluent middle class. These bills were "One Strike" where a resident of public housing was evicted for any accusation of crime and "Hope VI" where 166 cities were granted funding to demolish public housing and rebuild mixed-income housing.
The neighborhoods where public housing once stood, now serve only 42 percent of the mixed income housing and has created a severe affordable housing lack.
The neighborhoods were public housing once stood, are now sites for city attractions and half a million dollar and upwards real estate.
The neighborhoods where public housing once stood, are now gentrified neighborhoods with new occupants who are still trying to find their solace in it all.
So whose neighborhood is it anyway? The white middle class lived in most of these urban areas prior to the 1930's. The minorities and blacks have made these neighborhoods home and created culture in these areas since the 1950's. The investors are simply looking to capitalize on opportunities that will help the economy. The standard of neighborhoods are usually held together by all of the neighbors. These new neighborhoods should be no different. Create community organizations with leaders from all represented classes, work together to make the community cohesive, and fight back against the government for tax and rent controls instead of fighting against each other.


Today's recipe is a delicious and easy-to-make stew. It's the kind of recipe we prize here at Casual Kitchen because it combines easy to find ingredients in an unusual and highly original way.
This recipe is easily scalable (meaning you can double it with minimal incremental effort), it takes only about a half an hour to make, and it's so inexpensive that laughably cheap just isn't a strong enough word. Enjoy!
1) In a large pot, add oil, onions, garlic and Tabasco. Saute on medium heat for 5 minutes, until softened.
2) Add chopped collards, increase heat to medium high, and saute for 2-3 minutes.
3) Then add crushed pineapple (with liquid) and water. Bring everything to a boil, reduce heat back to medium and simmer for 10 minutes, stirring occasionally.
4) Finally, add peanut butter and stir well. Add slightly more water if the stew is too thick. Simmer another 5-10 minutes, stirring occasionally, until collards are cooked to your liking. Serve over white or brown rice.
1) This is a flexible, easily modifiable soup. You can increase or reduce the Tabasco for more or less heat. You can substitute other healthy and inexpensive greens for collards if you prefer: kale, swiss chard, cabbage, or even spinach are all potential candidates.
2) Note, however, if you plan to substitute other greens, be sure to adjust the simmering times to match the relative toughness of the greens you choose. You'll want to cook a tender green like spinach a little as possible, so I'd consider adding it just 3-4 minutes before you serve the soup. With a tougher green like cabbage, you might want to add an extra five minutes to the cooking time to make sure it's fully cooked to your liking.
Even assuming three extremely hungry people, this dish costs less than 80c per serving. Once again, further proof that healthy food does not have to be expensive.
4) Here's what Laura said when she tried this dish for the very first time: "Mmmmm. When I'm eating this stew, I can feel all the lutein from the collard greens soaking up into my maculas." Yep, we have some bizarre dinner conversation here at Casual Kitchen, but when you're married to an eye doctor, this is what passes for high praise.
This sounds amazing! I LOVE pineapple and peanut butter in savoury dishes... (though I've never had them together) and I actually have all of these ingredients on hand! So excited to make this tonight!!
Laura sounds like some kind of awesome. Those are the kinds of things that I like to say at dinner as well. My maculas are important to me!
So as soon as I saw the half cup of peanut butter I was hooked. I might have to switch out the pineapple due to this weird allergy that I've somehow acquired but i bet it would be great with mango.
Joanne, you probably could still make it with the pineapple--I'd try it. Because the sauce is simmered for a while, the heat may very well break down whatever it is in the pineapple that you're allergic to.
But if you try it with another fruit like mango, let me know your results!
Yum! This is super good! I have never had good luck cooking collard greens before and had figured that they just couldn't be made well without fatback or bacon grease, but this was easy and tastes awesome. I bet water chestnuts would be really good in this, too.
Kerrie, thanks for the feedback--I'm so happy you enjoyed it. And your idea of adding water chestnuts sounds intriguing, thank you for the idea!
Just made this for dinner tonight, and it was outstanding. I added a little yogurt at the very end, and we both added hot sauce at the table (we LOVE hot sauce). Thanks!
Thanks for the feedback Sarah, so happy to hear it!
I have a massive food aversion to Tabasco sauce (A doctor used to instruct me to put it in tea when I had throat infections. I do not recommend this.), so I added a healthy splash of apple cider vinegar and a mix of cayenne and crushed chilies instead. Delicious! Kind of a like a Thai curry. If I subbed frozen spinach, this could be a quick pantry-staple meal.


text:
Nalini Malani in conversation with Jyotsna Saksena, and Elvan Zabuyan at Kadist Art Foundation
May 21, 2013•Art, Exhibitions
Manjari Sihare shares details of a forthcoming event at the Kadist Art Foundation in Paris
Paris: The Clark House Initiative (Bombay) is currently presenting an exhibition at the Kadist Art Foundation in Paris of three Indian art practitioners, Padmini Chettur, a contemporary dancer, Prajakta Potnis, a visual artist, and Zamthingla Ruivah, a master weaver. The works in the exhibition are in dialogue with those of a group of Indian artists who were living in Paris in May 1968, including Nalini Malani, Krishna Reddy and polymath artist and magician Jean Bhownagary.
Nalini Malani, "For the Dispossessed", 1971
Image courtesy: Kadist Art Foundation, Paris
The Kadist Art Foundation and the Clark House Initiative have organized a series of public events around the exhibit, one of which is a conversation between Nalini Malani, political analyst Jyotsna Saksena, and art historian Elvan Zabuyan on Friday, 24 May at 7 pm. The talk will center around Malani's time in Paris which she describes as a 'prise de conscience'. She has lent to the exhibition a small papier mache head, 'For the Dispossessed' made in Paris in 1971 of the vivid pages of Le Nouvel Observateur, and referencing photographs of refugees fleeing the genocide during the Bangladesh Liberation War. The head also references what was happening in Paris at the time, demonstrations for Angela Davis, and protests of the Vietnam War.
Friday 24 May, 7pm: Nalini Malani, Jyotsna Saksena, and Elvan Zabuyan in conversation at the Kadist Art Foundation, 19 bis-21 rue des Trois Frères, F-75018 Paris.
tél. +33 1 42 51 83 49 | www.kadist.org
Art, Exhibitions
Clark House Initiative, Kadist Art Foundation, Nalini Malani in Paris

redpajama_set_name: RedPajamaCommonCrawl


Hungarian-born, Norbert Kael has always been interested in both classical and jazz music. He started his musical education at the age of 7. At 14 Norbert was accepted to Bela Bartok High School of Music, in Budapest, a school specially designed for talented young musicians. Mr. Kael received his first degree at the prestigious Franz Liszt academy of Music in Budapest. During those years Norbert Kael studied with Karoly Binder and Kalman Olah.
Regattabar, Berklee Performance Center among other concert venues throughout US. After moving to New York, Mr. Kael diversified his musical skills by learning from such masters as Seymour Lipkin and Matti Raekallio on the classical side as well as Kenny Barron on the jazz side.
Norbert has been pursuing the idea of combining classical and jazz styles since his early musical studies. Having been trained, studied, and performed in both musical styles, Norbert developed the tool to create a fusion of the two musical styles, and a new sound. Norbert approached the selected classical pieces with creativity, taste, and respect, that way he kept the original melody and character, but yet he put it into a new dimension.
Norbert Kael's innovative performances are happening in numerous countries: Europe, including Hungary, Russia, Belgium, Italy, Romania, Serbia also he played in USA, Mexico, and India. In Hungary, Opera, Academy of Music and Palace of Arts in Budapest are only few examples of places, where he is giving his captivating concerts.
The main criterion for them is your ability to repay any Wisconsin Loans Online, they are not interested in your previous attempts, the current one is all that matters. It is strictly forbidden to administrate Cialis Soft online in conjunction with medications, which are composed of nitrates - antidepressants, drastic analgetic pills, sleeping pills, and others.


text:
class CreateSafetyPlans < ActiveRecord::Migration
  def change
    create_table :safety_plans do |t|
      t.integer :client_id
      t.integer :created_by
      t.text :body

      t.timestamps
    end
  end
end


text:
Vintage Pulp Jul 9 2020
*sigh* I'm still confused how I was charged for not having something.
They say possession is nine tenths of the law, but that last tenth can get mighty interesting if the thing you don't possess when the cops come along is, for example, identification, or clothing, or, apparently morals. Paul Hunter's 1961 novel Morals Charge deals with an eighteen-year old named Nancy who is lusted after by her mother's boyfriend, falls into the clutches of a big city racketeer, is jailed on a morals charge and abused by cops intent on using her to snare bigger prey. Paul Rader handles the cover work here, and it's a typically excellent effort. Mid-century paperback art would be far less entertaining without him, and though everything he does is great, if you want to see some of our favorites, check here, here, here, and here. We also have a mini-collection here.
MidwoodPaul HunterPaul Radercover artliterature
She's not the sharpest ho in the toolshed.
Lana, by Joan Ellis, is sleaze fiction about a fifteen-year-old girl with poor critical reasoning skills. Which is to say she's D-U-M. Basically, she falls for an older guy who pimps her out. Her rationalizations around this are hilarious. Prostitutes often form co-dependent bonds with their pimps, so we hear, but Ellis didn't handle that aspect with sufficient skill, instead making poor Lana flat-out superficial. But hey—it's a sleaze novel. You don't go into it expecting Les Miserables. This is copyright 1960 with Paul Rader cover art (of a figure that looks a lot like Elsa Martinelli). By the way, if for some reason you don't know the term "ho," look here.
MidwoodJoan EllisPaul Radercover artliterature
Vintage Pulp Aug 27 2019
We'll play the corporate merger game later. Just this once I actually need you to type something.
Above you see a cover for Sin Now, Pay Later, which was written by Allan Horn, the keen literary mind behind such books as Molester's Trap and Whore from Maupin Street. And you wonder why all these guys wrote under pseudonyms. Sin Now, Pay Later is 1967 with cover art by Paul Rader.
MidwoodAllan HornPaul Radercover artliterature
You'll need to use some deodorant before I do anything like that again.
1964's The Mark of a Man tells the story of a mill worker in a dead end town who has simple desires, but whose girlfriend wants him to show more ambition. You know that's a recipe for trouble. Collier's prose is better than normal for Midwood, according to one review we read, but we're more interested, as usual, in artist Paul Rader, who was showcased on scores of Midwood covers and is great here as well. We've featured him often, but if you're unfamiliar with his work we suggest you behold his genius here, here, here, and here. You'll be glad you did.
MidwoodMax CollierPaul Radercover artliterature
You know what? Don't worry about it. The first time wasn't that great anyway.
Above, a Paul Rader cover for Twice with Julie by Jason Hytes, aka John Plunkett. The lesson here? Every man has his limitations. Copyright 1962.
MidwoodJason HytesJohn PlunkettPaul Radercover artliterature
Vintage Pulp Oct 30 2018
Once you go down there's no turning back.
But isn't Third Street in the other direction?
We're gonna go down the third street.
You mean the third street from here?
If you wanna think of it that way.
Why are you holding my hand?
The third street gets slippery. You'll see.
Super rare Joan Ellis authored Midwood-Tower lesbian sleaze novel about a female painter and female model who come together over more than just art, 1964, with Paul Rader on the cover chores.
MidwoodJoan EllisJulie EllisPaul Radercover artliteraturelgbt
Vintage Pulp Aug 3 2018
Why don't you get undressed and we'll have a coming in party instead.
It's mandatory to occasionally share a cover from Midwood-Tower, so above you see Coming Out Party by Kimberly Kemp, who was a pseudonym, in this case occupied by Gilbert Fox. The story involves a homeless beauty picked up on the street by a wealthy NYC couple who give her a place to live but turn her into a plaything—topless chores, nude photographs, sexual duties with the heads of house. You know—the usual maid stuff. They may be dirty people but at least everyone ends up sqeaky clean. The cover art is by Paul Rader, and the copyright is 1965.
MidwoodKimberly KempGilbert FoxPaul Rader cover artliterature
Vintage Pulp May 18 2018
It's not the size of the caucus that matters. It's what you do with it.
This one is self explanatory. Nick Vendor's Sabrina and the Senator, published in 1960 by Midwood Books with cover art by Paul Rader, is billed as a behind the scenes story of the private lives and public affairs of politicians and their playmates. Thanks to the current U.S. president, this sort of thing is on people's minds in a way it hasn't been since Bill Clinton. As fans and collectors of pulp fiction, we've always gleefully wallowed in political sleaze. Well we're up to our comb overs in it now.
MidwoodNick VendorPaul Radercover artliterature
*sigh* Okay, lesson learned—new sexual orientation, same old crushing regret.
Above is a piece of classic Midwood sleaze, The Drifter, by March Hastings, aka Sally Singer, 1962, with Paul Rader cover art and the staggeringly funny tagline: Any port in a storm—and one of the ports was Lesbos. In the story, a woman has an impotent but deviant husband who seems to be sexually inspired only by his sister, so wifey flees and the drifting begins. As does the slumming, self-hating, and everything else. Since lesbianism is universally understood in mid-century sleaze to be a mental disorder, it's no spoiler to reveal that our heroine doesn't stay docked in Lesbos permanently, but rather learns the usual dubious lesson imparted by these books: the love of a good man fixes everything. It's a sex conversion fantasy written for a male market, and not to be taken seriously in any way. As a side note, since Lesbos is a Greek isle, that means we have a bit of a theme today (see below).
MidwoodMarch HastingsSally SingerPaul Radercover artliteraturelgbt
I had new shocks installed, so theoretically nobody outside should be able to tell we're in there humping like beasts.
In Sin on Wheels a virgin moves into a trailer park with her new husband and discovers he and most of the other residents are swingers. He's cheating on her within a week, she's cheating back days later, and pretty soon everyone wants a piece of her wedding cake. Of course, it was always the husband's plan to share his bride, which means the friction, so to speak, derives from her attempts to resist being turned into a trailer park plaything. It's all written from her point of view, so it's basically a male fantasy of a woman's descent into the sexual gutter. This is credited to Loren Beauchamp but it was written by Robert Silverberg. If you're thinking this is somehow a diamond in the rough we'll tell you bluntly it's not distinguishable from most other light sleaze. It's fun and quick, though, with lots of heavy drinking, strip poker, and round robin intercourse. It's 1962 copyright, with Paul Rader cover art of one of his best temptresses, an aspect that contributes to the book's collectibility.
MidwoodLoren BeauchampRobert SilverbergPaul Radercover artliterature


The May Arts Design Team has a very special reason to Light It Up Blue for autism research today.
I have a couple of projects that I hope will inspire you to bless the life of someone you may know or the parents of someone you may know who is living with autism.
I found a puzzle cookie cutter and some gel paste food coloring at Sweet Baking Supply. (Excellent prices and fair shipping!) so I dug out my favorite Lemon Sugar Cookie recipe and created a "sweet" gift. I found the free printable labels here.
Cut with the puzzle cutter and bake.
If baking isn't your thing, I created this quick and easy flower seed envelope. I chose Forget Me Not Seeds because I thought the name was most appropriate and they're a beautiful blue.
I hand dyed some beautiful May Arts eyelet ribbon blue then stitched and gathered it into a spiral flower. Some beautiful sparkly blue embossing powder highlights the sentiment. I attached all my elements to a pretty paper doily then just clipped them to the bag with a hand dyed mini clothespin.
If you'd like the Lemon Sugar cookie recipe let me know. It's a delicious recipe I've used for years.
Be sure to visit the rest of the team on the hop for more Light It Up Blue inspiration and comment to win these beautiful blue ribbons of your very own.


Tuscany offers history, landscapes and a climate that are unique in Italy. Panoramic views, flavors, scents and culture, historical buildings, castles, archeological sites and gardens make our region enjoyable year round. It is a place that blends the charm of local folklore with a passion for historical events and captivates people of every age from all over the world.
La Cerreta wants to open a window on this region of incredible and indisputable value by inviting our guests to discover it and experience it to the fullest. That way either a short weekend or a long vacation may become a longlasting memory and source of inspiration.
A few minutes by car from La Cerreta and you can reach splendid villages of historical importance, where charming views and the narrow streets and steps winding around the houses pulse with the rhythms and culture of living "alla Tuscana", in the understanding of time, the pleasure of good food and wine, and conversation that is genuine and witty. Sassetta, Suvereto, Campiglia Marittima, Bolgheri, Massa Marittima and Populonia are the places closest to us, but we cannot exclude Monteriggioni, Volterra, Montalcino and Certaldo.
Stretching for more than 150 kilometers between Livorno and Monte Argentario, the coast offers everything from fully equipped beaches and hidden sandy strips to rocky coastline accessilble only to hiking enthusiasts. It is right for anyone wanting to plunge into the sea and sunbathe during spring and summer, but also for anyone wanting to enjoy the sunsets and breathtaking views between sky and sea and to breathe in the sea air from off the waves.
Tuscany's sea gems are scattered between the Ligurian and Tyrrhenian Seas: the islands of Elba Gorgona, Capraia, Giglio, Giannutri, Pianosa and Montecristo, the latter having received the Council of Europe's Diploma of Protected Areas and visited only with special authorization. It takes between 40 minutes and 2 hours by ferry from the harbors of Livorno, Piombino, Porto Santo Stefano and Rosignano to discover true corners of paradise, natural parks, marinas, coves and beaches nestled into the rocky coastline.
Once ancient Etrucscan and Roman settlements, Tuscany has a high concentration of cities and art centers that boast an outstanding cultural wealth due to its museums, castles, old buildings, city walls, historical residences and gardens, and finally churches and cathedrals that bear testimony to the most flourishing periods of monumental Italian architecture. A regional and national heritage to preserve, discover and learn more about with every visit.


text:
Amanda Qadri
Attorney, Miami /
Amanda Qadri is an Attorney in the firm's Miami office, focusing her practice on First Party Insurance Defense, Property and Casualty Claims, and Complex Commercial Constructions Disputes.
Before joining the firm, Amanda worked as an Attorney for a state-wide personal injury law firm, where she obtained extensive litigation experience managing an independent caseload from the inception of suit to trial, including serving as the second chair in a bench trial for an ownership dispute in a wrongful death action. Amanda has experience handling negligence actions in state and federal court.
Amanda earned her Bachelor of Science degree, magna cum laude, in Criminal Justice from Florida International University, where she was Phi Beta Kappa and received a spot on the Dean's List five times. She then went on to earn her Juris Doctor degree from Florida State University College of Law.
During her tenure in law school, Amanda received three Book Awards for earning the highest overall grade in the following courses: Elder Law, Criminal Practice Clinic, and Florida Criminal Procedure Pretrial. Amanda was a member of the Trial Team and served as a Teaching Assistant to Professor Talbot "Sandy" D'Alemberte. Further, Amanda is acknowledged in Georgetown Law Journal and Iowa Law Review for her research assistance to Professor Justin Sevier. Amanda also worked with the Office of the State Attorney as a Certified Legal Intern where she tried multiple bench trials and served as the second chair in a jury trial.
Amanda has working knowledge in Spanish and Arabic.
On the Move, Daily Business Review, January 25, 2019
People on the Move, Sun-Sentinel, January 6, 2019
On the Move, Florida Bar News, January 1, 2019
Kelley Kronenberg Welcomes Attorney Amanda Qadri, Sun-Sentinel, December 21, 2018
Class of 2017, Florida State University College of Law, December 20, 2018
Kelley Kronenberg Welcomes Three Attorneys to its Miami Office, Attorney at Law Magazine, December 20, 2018
Kelley Kronenberg Adds Attorneys Lizbell R. Lucero, Amanda Qadri and Danielle A. Wallis to its Miami Office, CityBizList, December 18, 2018
Kelley Kronenberg Welcomes Attorneys Lizbell R. Lucero, Amanda Qadri and Danielle A. Wallis to its Miami Office, Legal Learning Series, December 18, 2018
Email Amanda Qadri
Office:(305) 503 - 0850
Construction Defect Litigation
United States District Court, Southern District of Florida
Florida State University College of Law, J.D., 2017
Florida International University, B.S., magna cum laude, 2014


After his record-setting season for the Rochester Americans, veteran defenseman Zach Redmond will need to clear shelf space for all his awards.
His latest he might just sleep with under his pillow.
On Tuesday, the American Hockey League announced that Redmond is the recipient of the 2018-19 Eddie Shore Award, given to the league's top defenseman.
The prestigious honor is voted on by coaches, players and media members in each of the AHL's 31 cities, and Redmond, 30, is just the third Rochester player to win the award in the franchise's 63 seasons.
AHL Hall of Famer Steve Kraftcheck won in 1959, the first season for the award named in honor of Shore, who starred 14 seasons for the Boston Bruins in the 1920s and 1930s and is regarded as one of the game's greatest defenseman ever.
Hockey Hall of Famer Al Arbour won in 1965 during Rochester's Calder Cup halcyon days.
It was hard not to take notice. Redmond put together a spectacular regular season for Rochester with 21 goals and 50 points, both career highs, in 58 games to go with a plus-13 rating.
His goal total broke a 46-year-old franchise record for a defenseman held by Rick Pagnutti and led all AHL defenders. His nine game-winning goals tied for the overall league lead and he ranked first among blueliners with 10 power play goals, helping the Amerks (46-23-5-2) record the third-best overall record with 99 points.
Last week, Redmond was named an AHL First-Team All-Star and at Friday's Fan Appreciation Night at Blue Cross Arena, he took home the Amerks' Booster Club's Most Valuable Player and Most Popular Player awards. His MVP was voted on by teammates.
A native of Traverse City, Michigan, Redmond was acquired in a trade with Montreal by the parent Buffalo Sabres in October 2017 for Nicolas Deslauriers.
He has proceeded to play the best hockey of his eight-year pro career, scoring 15-32 – 47 in 66 games for the Amerks last season, which earned him a new two-year contract.
"He's thought of very highly in this organization, as a leader and a player,'' Amerks coach Chris Taylor said.
Redmond's personal story continues to inspire people in all walks of life, not just hockey.
Twice he has overcome life-threatening injuries to resume his playing career, the first occurring when he was 15 and suffered a stroke while playing midget hockey for a team in Detroit.
Ten years later in 2013, a Winnipeg Jets' teammate accidentally sliced Redmond's femoral artery and vein with his skate blade. Redmond lost half the blood in his body and needed 200 stitches. Doctors thought he'd never play again, but he proved them wrong.
Of course, Eddie Shore would appreciate Redmond's toughness and determination. After his NHL playing days, Shore won a total of seven Calder Cups, two as GM/coach of the Buffalo Bisons and five as owner of the Springfield Indians.
Four other defenseman who wore the Amerks sweater won the Eddie Shore Award with other teams: Richie Dunn, Binghamton, 1985; Jim Wiemer, New Haven, 1986; Dave Fenyves, Hershey, 1988 and '89; and T.J. Brennan, Toronto, 2016.
The Amerks open the playoffs with a best-of-five series against Toronto and host Games 1 and 2 Friday and Sunday.


text:
About One More Soul
One More Soul Canada
Bishops Speak Out
A Theology of Life-Giving
NFP and married life
Love & Chastity
NFP web links
Risks & Consequences
Sterilization Reversal Stories
NFP-Only Directory
Make Straight The Pathway 2012
Residency Database
Published NFP Studies
Downloadable MP3s
Packets & Gift Sets
Resource Guide 2013
English Pamphlets
« Doctor Told Mom 5 Times to Abort Baby With Missing Brain, She Refused and His Brain Has Grown Back
Individualism feeds today's culture of death »
Catholics must stand with Blessed Virgin to combat abuse crisis in Church
Editor's note: An international group of lay Catholics held a public demonstration in Rome yesterday just outside the Vatican, demanding that Pope Francis and the world's bishops address homosexuality during the upcoming abuse summit as the major cause of the sexual abuse crisis in the Catholic Church. The following statement was given by Arkadiusz Stelmach during a press conference at the event. Read all statements here.
February 20, 2019 (LifeSiteNews) – I come from Poland, the country that owes its existence to the Catholic Church. I come from a country which, by virtue of the royal act, declared the Blessed Virgin Mary the Queen of Poland.
Like the entire Catholic world, we Poles are sad about the condition of the Church and Christian Civilization. Yes, the Church and Christian Civilization are being destroyed for over five centuries by the gnostic and egalitarian Revolution.
Today we see a dramatic struggle between the Revolution and the Counter-Revolution within the Church.
We see how the red dragon in a new form of neo-Communism or neo-Marxism got insidiously into the Church, making in Her previously unknown devastation.
Unfortunately, also my beloved Poland is not free from this scourge. We are living part of the Catholic Church. We are struggling with the crisis of Faith – manifested in the fall of vocations to the priesthood, the decline of religious practices especially among young people, the scourge of immorality, the promotion of homosexuality and gender ideology. Unfortunately, our seminaries and universities are not free from the terrible ideology of progressivism, which effectively undermines doctrine, discipline, and pastoral work of the Church.
A year ago, the Fr. Piotr Skarga Institute, who I represent, conducted a completely unique campaign of Polonia Semper Fidelis in defense of the indissolubility of Catholic marriage and in defense of the Blessed Sacrament. This action was an expression of the concern of Polish Catholics with an unclear and thus dangerous doctrine on the indissolubility of Sacrament of Marriage contained in the papal document Amoris Laetitia. The Polish episcopate received, in effect, over 145,000 letters, the vast majority of them by traditional post. In the letters, the Polish faithful appealed to the Polish Bishops' Conference to confirm the Church's teaching on the indissolubility of marriage, as well as to prevent of receiving Holy Communion by divorced Catholics that are living in the non-sacramental unions.
It's sad that until now we didn't receive any answer from the Polish episcopate for the campaign.
Unfortunately, the past months have brought further information about the extent of the crisis and confusion in the Church.
Letters from Archbishop Viganò, unmasking scandals of sexual abuse against children and clerics; attempts to democratize and destroy the hierarchical structure of the Church arouse our greatest concern.
Unfortunately, it also coincides with the increasingly furious attacks on the Church in Poland by external enemies. A sad example of this is the movie "Clergy" that presents a deformed and one-sided picture of the Church as a corrupt organization.
This very tragic situation of the Church calls us to be faithful to the clear traditional Catholic teaching and doctrine. In Poland — my country — the Mother of God, Blessed Virgin Mary, was always venerated and was our hope in most dark hours of our history. That's why we need to stand with Her and pronounce: "Credo in Unam, Sanctam Catholicam Ecclesiam" (I believe in one, holy, Catholic Church) and that gates of hell will not destroy the Church.
This entry was posted on Thursday, February 21st, 2019 at 8:53 pm	and is filed under News & Commentary. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.
or search by zip code:
Patty Schneier
In "Prove it God" Patty Schneier speaks as a Catholic woman and mother in our modern times. She tells her personal story of how God worked in her heart to turn her away from contraception and toward Natural Family Planning.
Patty Schneier's "Prove It, God" ...And He Did is available to listen to for free! Order it!
https://onemoresoul.com/audio/CPHD.mp3
Stephen Patton M.A., J.D.
Stephen Patton's "Why Contraception Matters" talk is available to listen to for free! Read it! Order it!
https://onemoresoul.com/audio/CWCM.MP3
La charla de Stephen Patton "Porque Importa la Anticoncepción" esta disponible aqui para que la escuchen gratis! Leela! Ordenala!
https://onemoresoul.com/audio/CWCMsp.mp3
What a Woman Should Know about Birth Control - 176 emails
The Cross in Our Bodies - 164 emails
20 Ways for Young Women to Claim the Respect They Deserve - 146 emails
The Tunnel of Parenthood - 133 emails
20 Ways for Young Men to Become REAL Men - 105 emails
Chickenpox Vaccine Use is Highly Statistically Related to Autism Disorder - 100 emails
Priest warns Obama: Better knock the Catholic Church out now – you've awakened the giant - 87 emails
Chastity: What are you saying YES to? - 65 emails
The Christian View of Sex: A Time for Apologetics, not Apology - 62 emails
Why Contraception Matters - 51 emails
Stuff you might like
The Billings Ovulation Method Code: PBOM
The Squire and the Scroll Code: BSAS
NFP Outreach
Copyright © 1997-2020 One More Soul.
One More Soul


text:
Poland to spend USD 133 Billion on Modernization of the Armed Forces. New F-16 To Be Ordered
Image Credit: Maciej Szopa/Defence24.pl
Maciej Szopa
Technical Modernization Plan
2021-2035 Technical Modernization Plan
Mariusz Błaszczak
Narew programme
Harpia Programme
Harpy Claw
Head of the Polish Ministry of Defence, Mariusz Błaszczak, signed a new Technical Modernization Plan for the period 2021-2035, also covering the year 2020.
It was on 10th October 2019 when the head of the Polish MoD approved one of the most important documents for the Polish defence and security - the Technical Modernization Plan for the period between 2021 and 2035, with consideration given to the year 2020. As noted by Błaszczak, to make the whole process more efficient, effective and more agile, he made a decision to extend the planning period from 10 to 15 years. The defence procurement contracts are convoluted and costly and they require a lot of workload. Extending the planning period has paved the way towards establishment of legal basis for conclusion of long term agreements, the Minister said.
The new plan envisages modernization expenditure that would match the expectations of the Polish soldiers. We're speaking of a sum of 524 billion zlotys, ca. 133 billion US dollars, allocated to procurement of new armament and equipment for those who protect our security. No government in the Polish history so far has been able to allocate sums so large to modernization of the Polish military.
Mariusz Błaszczak, Polish Minister of Defence
F-35, loyal wingman and extra F-16s.
Błaszczak, when speaking of modernization programmes, indicated that "Harpia" is the key programme that has already been launched, and that bears a fundamental meaning for the Polish defence capabilities. The programme concerns acquisition of 32 fifth generation F-35 MRCA. - We have already begun negotiation with the US government, following the Congress's approval of the purchase. Finalization of this contract, the most significant one in the history of Poland is just a matter of time, said the head of the MoD
Image Credit: Maciej Szopa/Defence24
"Harpi Szpon" [Harpy Claw] programme, on the other hand, is a new initiative complementing the "Harpia" programme and reinforcing the strike capabilities of the Polish fighter aircraft.
"Poland would be trying to get involved in the "loyal wingman" programme aimed at developing a stealth UAV. A drone as such would be learning the pilot's behaviour as early as at the training stage, with the training aimed at joint execution of reconnaissance or combat sorties. Controlled by the pilot the drone would be able to conduct strikes against well protected enemy assets, deep behind the enemy lines, not exposing the pilots to the threat directly. Use of those systems that would involved manned/unmanned teaming would also enhance strike capabilities thanks to the use of a myriad of guided missiles or bombs", the head of the MoD said.
The Technical Modernization Plan also envisages extra assets being allocated to procurement of extra F-16 aircraft for the Polish military.
Reconnaissance - "Obserwator" Programme
"Contemporary battlefield is, above all, information-driven. Thus, we have prepared a programme aimed at comprehensive development of capabilities related to multi-level and integrated satellite and imagery reconnaissance. Within the framework of the new "Obserwator" [Observer] programme, the military would procure satellites, microsatellites, reconnaissance aircraft and a whole spectrum of drones, with the intelligence they gather being collected and analyzed at an IMINT analysis centre and used for further operations by the troops", head of the Polish Ministry of Defence said.
Air Defence. Wisła and Narew
As noted by the Minister, the "Wisła" programme would still undergo development. Its aim is to acquire medium range air/missile defence systems. "Narew" programme would come alongside, constituting the second element of the multi-layered national IADS.
Helicopters: Kruk comes next
"The Technical Modernization Plan also envisages acquisition of helicopters. Following the procurement of helicopters for the Special Operations Forces and for the Navy, we would finalize the "Kruk" programme. Thanks to the aforesaid initiative we would acquire modern attack helicopters for the Army. We would also be continuing the "Homar" programme covering the acquisition of rocket launchers capable of attacking targets 300 kilometers away", Mariusz Błaszczak announced.
Navy: Miecznik, Orka and Murena
The latest Technical Modernization Plan also includes the "Miecznik" programme (coastal defence vessels, two surface combatants as such would be acquired), as well as the "Orka" programme, with a gap filler planned allowing the MoD to procure two submarines soon, at the same time ensuring continuity of training for the sailors. The Polish military would also procure six light missile boats, expected to be built at the Polish shipyards, within the framework of the "Murena" programme.
Fighting Vehicles
According to the assumptions of the new Technical Modernization Plan, acquisition of the Krab self-propelled howitzers, Rak self-propelled mortars and Rosomak APCs would continue. - "We will reinforce the anti-tank capabilities by completing the "Pustelnik" programme aimed at acquisition of modern light ATGM launchers", Minister said.
- "End of an era would come for the Post-Soviet obsolete BWP-1 infantry vehicles. "Borsuk" programme is aimed at replacing those with a modern design, developed and manufactured in Poland. Recently we had a chance to get acquainted with the advancements in the "Borsuk" programme, during the MSPO event in Kielce. According to what I had said earlier, we would also be acquiring new generation main battle tanks, within the scope of the "Wilk" programme", head of the MoD said.
One of the programmes that has been developed with the Polish defence industry in mind is the "Ottokar-Brzoza" project assuming that several examples of tank destroyers for an anti-tank regiment would be acquired.
Engineering Forces
The new plan also includes the "Balsa" programme aimed at acquisition of more modern engineering robots for the bomb disposal units. Those would ensure detection, removal and neutralization of unexploded ordnance and remotely controlled explosive devices. The robots are being developed, in their entirety, by the Polish engineers and manufactured by the Polish defence industry. Daglezja programme is another initiative that would be implemented.
Gladius and Groszek
- "We also keep the innovative tech in our minds. Within the framework of the "Groszek" ["Peas"] programme we will procure pods for the combat aircraft that would release submunitions automatically reacting to the detected threats. This armament would make it possible to act against large elements of the enemy forces, such as mechanized or armoured units or aircraft and helicopters parked at the airbases. "Gladius" programme, meanwhile, would be aimed at procuring unmanned search-strike systems, so called "loitering munitions"." – head of the MoD said.
The Polish military would still be working on the Cyber.mil programme. Within the framework of that initiative a bundle of domestic tools and software would be created, making use of the latest Polish cryptography. This will make it possible to efficiently protect the Polish cyberspace.
Modernization Programme - Coherence with the Analytical Effort
General Rajmund Andrzejczak, Chief of the General Staff of the Polish Military, provided some extra information. As Andrzejczak said, extra analytical effort has been undertaken this year aimed at scrutinizing the operational environment with the upcoming period of time and the distant year 2035 taken into account. All of that would be done to prepare the military to carry out the "very ambitious tasks". The analysis has been and still is conducted quite broadly, also beyond the domain of defence and security, with demographics, urbanization, climatic change, technological advancements and regional context all taken into account. General noted that preliminary results of those analytical works have already been obtained and they are being put in sync with the operational programmes implemented as a part of the Technical Modernization Plan. The modernization plans are also visible in the experimental rapid deployment and operational autonomy exercises executed by the Polish military this year.
C2 Systems
Andrzejczak also recalled the fact that ability to effectively attack the enemy may be the primary capacity at hand of the military, but command systems play a role that is at least tantamount.
In the programmes planned we expect complete digitalization of the combat platforms to depart from the analogue system. We want to balance out the systems that are placed in the areas covered by the digital transformation and cyber processes with those that are available now. The conclusions drawn from the exercises conducted, also at vast distances and with high level of dynamics, created a foundation for us to increase the SATCOM use intensity, with SATCOM being covered by those programmes. Without means of communication as such and without those capabilities we are unable to effectively establish a command system. [...] Integrated complex reconnaissance system is another matter. Satellites mentioned here act as an example of transition to another domain, beyond cyber, namely the space domain. Here we hope to have the EO IMINT satellites and microsatellites enhance the situational awareness and thus become the integral part of the military and of its reconnaissance system.
General Rajmund Andrzejczak, Chief of the General Staff of the Polish Military
Andrzejczak also referred to the Harpia programme and to the F-35. He said that F-35 would be a strike and command and, above all, recce platform that is also going to use support from the UAVs. New electronic warfare plan has also been listed as one of the priorities by Andrzejczak. "Podkowiec" and "Kaktus" programmes are thus expected to gain high tempo, so that become tangible as soon as possible.
2020 would also be focused on training of the reserve forces, Andrzejczak said. He also emphasized the fact that harmonious inflow of new equipment is the goal of the currently executed procurement programmes.


text:
Third Brigade
Third Brigade (HMA7Q)
First Division - Third Corps
— Army of the Potomac —
Third Corps First Division
Col. P. Regis De Trobriand
17th. Maine 3d. 5th. Michigan 40th. New York
110th. (6 Cos.) Pennsylvania Infantry
July 2 Arrived at 10 a.m. On the advance of the Division between 2 and 3 p.m. the Brigade took position in column between First and Second Brigades for support to either. The 3d Michigan was sent to support First Brigade. The 17th Maine moved across the Wheatfield to the stone wall on the south. The 40th New York was sent to the gorge between the Devils's Den and Little Round Top. The 5th Michigan and 110th Penna. held the summit commanding a ravine in front and east of the Rose buildings until relieved by two Brigades of Fifth Corps when they retired through the Wheatfield where being joined by 17th Maine they held back a superior Confederate force until the arrival of First Division Second Corps when ammunition being exhausted this portion of the Brigade retired and at night was joined by the other regiments.
July 3 In Reserve.
Casualties. Killed 4 officers 71 men. Wounded 28 officers 366 men. Captured or missing 21 men. Total 490.
HMA7Q
Gettysburg National Military Park Commission
Saturday, September 27th, 2014 at 7:46am PDT -07:00
At or near 218-250 Sickles Ave, Gettysburg PA 17325, US
Second Brigade
4th Michigan Infantry
57th New York Infantry
The Bloody Wheatfield
62nd Pennsylvania Infantry
17th Maine Infantry
115th Pennsylvania Infantry
Field Hospital of the 32nd Massachusetts Infantry
The Irish Brigade
This marker can also be identified by its HM code. You can use the hashtag #HMA7Q in tweets, and any other place where you might refer to this marker, including when searching on this site.