feat: limit concurrent DoQ streams and goroutines (#7296)

man/coredns-quic.7

@@ -0,0 +1,69 @@
+.\" Generated by Mmark Markdown Processer - mmark.miek.nl
+.TH "COREDNS-QUIC" 7 "May 2025" "CoreDNS" "CoreDNS Plugins"
+
+.SH "NAME"
+.PP
+\fIquic\fP - configures DNS-over-QUIC (DoQ) server options.
+
+.SH "DESCRIPTION"
+.PP
+The \fIquic\fP plugin allows you to configure parameters for the DNS-over-QUIC (DoQ) server to fine-tune the security posture and performance of the server.
+
+.PP
+This plugin can only be used once per quic Server Block.
+
+.SH "SYNTAX"
+.PP
+.RS
+
+.nf
+quic {
+    max\_streams POSITIVE\_INTEGER
+    worker\_pool\_size POSITIVE\_INTEGER
+}
+
+.fi
+.RE
+
+.IP \(bu 4
+\fB\fCmax_streams\fR limits the number of concurrent QUIC streams per connection. This helps prevent DoS attacks where an attacker could open many streams on a single connection, exhausting server resources. The default value is 256 if not specified.
+.IP \(bu 4
+\fB\fCworker_pool_size\fR defines the size of the worker pool for processing QUIC streams across all connections. The default value is 512 if not specified. This limits the total number of concurrent streams that can be processed across all connections.
+
+
+.SH "EXAMPLES"
+.PP
+Enable DNS-over-QUIC with default settings (256 concurrent streams per connection, 512 worker pool size):
+
+.PP
+.RS
+
+.nf
+quic://.:8853 {
+    tls cert.pem key.pem
+    quic
+    whoami
+}
+
+.fi
+.RE
+
+.PP
+Set custom limits for maximum QUIC streams per connection and worker pool size:
+
+.PP
+.RS
+
+.nf
+quic://.:8853 {
+    tls cert.pem key.pem
+    quic {
+        max\_streams 16
+        worker\_pool\_size 65536
+    }
+    whoami
+}
+
+.fi
+.RE
+