quotas? / how to prevent a denial-of-service attack when a user writes too much

[glycerine]

Thanks for making actordb available -- I'm impressed by the strong foundation it provides.

Question:

If I have an actor representing a user's saved configuration, so that external users can add data to it, how can I establish a quota. Rationale: I want to prevent DOS attacks. I'd like the user to not be able to, either mistakenly or maliciously, do a denial of service attack by writing too much data to their configuration actor.

I see that sqlite has a quota operation at the C-level that refers to groups of files [1], however

a) I doubt that API will work now that storage is inside lmdb; and

b) I don't see anywhere where that quota setting is exposed via sql.

[1] http://www.sqlite.org/src/doc/trunk/src/test_quota.c

Alternative to quotas:

If there is a way to query how much space is currently being consumed by an actor, I could add application level checks and refuse to write more.

[SergejJurecko]

Right now you could do a sql statement that counts how many rows an actor has. In the next versions we could expose some sqlite PRAGMA statements. For you the relevant ones would be PRAGMA page_count and PRAGMA freelist_count. page_count - freelist_count is how many pages contain data (page is 4k). Would that be enough?

[glycerine]

page_count - freelist_count is how many pages contain data (page is 4k). Would that be enough?

Despite being somewhat rough, I think that would suffice. I just don't want somebody writing terabytes into an actor that should have a 50MB limit.

[SergejJurecko]

Added in 0.10.23 released today

[glycerine]

Excellent news. Thank you @SergejJurecko !