Mitigate relay-details DNS lookup availability risk

[JuliusHenke]

Motivation

• The public relay/** details endpoint performed unbounded, synchronous PTR and forward DNS lookups in the HTTP request path, allowing attacker-controlled PTR responses or slow DNS to tie up request threads and cause availability loss.
• The cache previously only stored completed results and did not prevent concurrent cache-miss stampedes for the same IP, so multiple clients could all trigger heavy DNS work simultaneously.

Description

• Bound verification work by adding MAX_PTR_HOSTNAMES_TO_VERIFY = 10 and applying .take(MAX_PTR_HOSTNAMES_TO_VERIFY) to the distinct PTR hostnames list in ReverseDnsLookupService.lookupHostNames to cap forward-lookup calls per request. (backend/src/main/kotlin/org/tormap/service/ReverseDnsLookupService.kt)
• Enabled synchronized cache loading by adding sync = true to the @Cacheable annotation for reverse DNS lookups to reduce concurrent cache-miss stampedes for the same IP. (backend/src/main/kotlin/org/tormap/service/ReverseDnsLookupService.kt)
• Added a unit test "lookupHostNames limits number of host names verified" to ReverseDnsLookupServiceTest that verifies only 10 forward lookups are performed when PTR returns 20 names. (backend/src/test/kotlin/org/tormap/service/ReverseDnsLookupServiceTest.kt)

Testing

• Added an automated unit test case in org.tormap.service.ReverseDnsLookupServiceTest that asserts the hostname verification limit and expected forward-lookup call count.
• Attempted to run the tests with ./gradlew test --tests org.tormap.service.ReverseDnsLookupServiceTest --no-daemon, but the run failed in this environment due to a JVM/Gradle compatibility issue reported as 25.0.1, not due to the test logic itself, so tests could not be executed here.
• No other automated test runs were completed in this environment.

---

Codex Task

[Copilot]

Pull request overview

This PR aims to reduce reverse-DNS availability risk in the backend relay-details flow by limiting per-request hostname verification work and coalescing concurrent cache misses for the same relay IP.

Changes:

• Adds a 10-hostname cap to PTR hostname verification in ReverseDnsLookupService.
• Enables synchronized cache loading for reverse-DNS lookups with @Cacheable(..., sync = true).
• Adds a unit test covering the verification cap behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
backend/src/main/kotlin/org/tormap/service/ReverseDnsLookupService.kt	Caps PTR verification work and enables synchronized cache loading for reverse-DNS results.
backend/src/test/kotlin/org/tormap/service/ReverseDnsLookupServiceTest.kt	Adds unit coverage for the new hostname-verification limit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.