Harden discovery rendezvous service

netfishing_discovery/server.py

@@ -47,6 +47,7 @@ class ServerConfig:
     traversal_bind_host: str = "0.0.0.0"
     traversal_port: int = 7771
     traversal_public_host: str = "127.0.0.1"
+    build_revision: str = "unknown"
 
     @classmethod
     def from_environment(cls) -> "ServerConfig":
@@ -82,6 +83,10 @@ class ServerConfig:
             traversal_public_host=os.getenv(
                 "NETFISHING_DISCOVERY_TRAVERSAL_PUBLIC_HOST", "127.0.0.1"
             ),
+            build_revision=(
+                os.getenv("NETFISHING_DISCOVERY_BUILD_REVISION", "unknown").strip()
+                or "unknown"
+            )[:64],
         )
 
 
@@ -112,6 +117,7 @@ class DiscoveryRequestHandler(BaseHTTPRequestHandler):
                     "status": "ok",
                     "service": "netfishing-discovery-server",
                     "version": __version__,
+                    "build_revision": self.server.config.build_revision,
                     "active_rooms": self.server.registry.room_count(),
                 },
             )
@@ -359,8 +365,10 @@ def _install_signal_handlers(server: BaseServer) -> None:
     signal.signal(signal.SIGTERM, stop_server)
 
 
-class TraversalUDPServer(socketserver.ThreadingUDPServer):
-    daemon_threads = True
+class TraversalUDPServer(socketserver.UDPServer):
+    # Each packet performs one bounded JSON decode and one locked registry
+    # operation. A serial loop avoids creating an attacker-controlled thread
+    # for every untrusted datagram.
     allow_reuse_address = True
 
     def __init__(self, config: ServerConfig, registry: RoomRegistry) -> None:
@@ -427,6 +435,7 @@ def main() -> None:
             traversal_bind_host=config.traversal_bind_host,
             traversal_port=config.traversal_port,
             traversal_public_host=config.traversal_public_host,
+            build_revision=config.build_revision,
         )
     logging.basicConfig(
         level=getattr(logging, arguments.log_level.upper(), logging.INFO),