[rabbitmq-discuss] Security/resource limit questions

[Christian Legnitto]

I intend to have RabbitMQ publicly available over the internet via AMQP and have some outstanding questions. I haven't had time to investigate these myself, but figured I'd send to the list as someone else may have the answers already. I am asking these about RabbitMQ itself. I realize the client libraries may have limitations of their own, possibly different.

* What characters are allowed / expected in the routing key, binding topic, queue name, user name, and password? Is it just ASCII? 
* What is the maximum length of the routing key, binding topic, queue name, user name, or password a client can specify? 
* If a message is rejected due to hitting max length or an invalid character, what happens? How are the limits enforced? Rejection? Truncation? Conversion?
* How many bindings are supported per queue? Is it possible to starve the broker of resources be specifying 100000s of bindings?
* Is it possible for malicious consumers to DOS the server by specifying 100000s of queues with 100000s of bindings listening to '#' on all exchanges?
* Is it possible for a malicious producer to be able to affect the AMQP message / behavior by including control characters / AMQP escape sequences in the message payload?
* Is it possible for malicious consumers to starve the broker of connections during protocol negotiation or consuming? What are the timeouts in place to prevent such an attack? Are they configurable?

Thanks,
Christian