Re: How Ada could have prevented the Red Code distributed denial of service attack.

[James Rogers <jimmaureenrogers@worldnet.att.net>]

Chris Wolfe wrote:
> 
> It does not require any overwhelming work to convert an Ada
> program directly into a functionally identical C++ program using
> appropriate (non-standard) templates. Amazingly these templates
> also tend to spawn safe versions of the standard C functions.
> What was that drivel about pipe again?
> 

Be careful about such expansive statements. It is easy to read your
reply to imply that you can convert ANY Ada program to C++ without
overwhelming work. 

It is true that you can make such conversions for some Ada programs.
It is not true that all Ada programs can be converted to C++ wihtout
overwhelming work. 

Specifically, how would you code the C++ program to contain all the
checks built in by the Ada compiler, including the checks done at
compile time? How would you, without overwhelming work, convert
an Ada multi-tasking program using Ada protected objects for
asynchronous task communication, into C++?

For example, how would you, without overwhelming work, convert the
following Ada code:

-----------------------------------------------------------------------------
-- Inventory
-- Protected object for use of production lines
-----------------------------------------------------------------------------
   generic
   
   Max_Size : Positive;
   type Items is private;
   
   package Inventory is
   
      subtype Buf_Index is Positive range 1..Max_Size;
      type Parts_Buffer is array(Buf_Index) of Items;
   
      protected type Parts_Buf is
         Entry Put(Item : in Items);
         Entry Get(Item : out Items);
      private
         Buffer : Parts_Buffer;
         Oldest : Positive := 1;
         Newest : Positive := 1;
         Size   : Natural  := 0;
      end Parts_Buf;
   
      type Parts_Buf_Ptr is access Parts_Buf;
   
   end Inventory;


   package body Inventory is
   
   ---------------
   -- Parts_Buf --
   ---------------   
      protected body Parts_Buf is
      
      ---------
       -- Get --
      ---------
      
         entry Get (Item : out Items) when Size > 0 is
         begin
            Item := Buffer(Oldest);
            if Oldest < Buffer'Last then
               Oldest := Oldest + 1;
            else
               Oldest := Buffer'First;
            end if;
            Size := Size - 1;
         end Get;
      
      ---------
      -- Put --
      ---------
      
         entry Put (Item : in Items) when Size < Buffer'Last is
         begin
            Buffer(Newest) := Item;
            if Newest < Buffer'Last then
               Newest := Newest + 1;
            else
               Newest := Buffer'First;
            end if;
            Size := Size + 1;
         end Put;
      
      end Parts_Buf;
   end Inventory;

You will need to implement the full functionality of protected objects
including entry queuing, object locking, and boundary conditions.
You will also need to implement the integer range bounds limitations
created by the definition of the Positive subtype. It would be nice
if you could also define arrays with a beginning index of 1 rather
than 0, but you would probably assert that 0 based indexing is
equivalent to 1 based indexing. Curious, if it is equivalent, then
why can't C++ implement such an array directly?

Oh yes, when calling the Put and Get entries, your code must execute
in the calling thread. That thread must suspend until the entry
executes.
The entry may only execute when the boundary condition is true, and
no other entry is concurrently accessing the protected object.

You will have to implement the protected object as a template to be
equivalent. This means that you must find some way to specify that
one of the generic parameters is an integer greater than or equal to
1. If the parameter does not meet this requirement the code must not
compile. Putting the check in runtime code is not equivalent.

To make the code truly equivalent you must not define your data to 
be dynamically allocated. All items placed on the buffer must be
statically allocated.

Jim Rogers
Colorado Springs, Colorado USA