realXtend/naali — Issue #364: Add support for limiting the amount of content in a client scene.
Author: juj
Created: 2012-02-17 17:36:06+00:00
State: open
Labels: Feature Request, Security

To disallow memory exhaustion attacks, implement configurable hard limits (both client and server side, where applies) on at least the following:

1. Number of concurrent connections. Number of concurrent connections from a single IP (these are potential for kNet level)
2. Number of scenes. Number of entities in a scene. Number of components in an entity. Number of attributes in a component.
3. Maximum length of variable-length content in attributes.
4. Maximum length of entity action messages.
5. Number of asset storages.
6. Number of assets in the Asset API. Number of concurrent transfers in the Asset API.
7. Maximum asset size, both encoded and decoded (asset-specific).
What else?