{"record":{"id":"d86d2a3bb2148431","repo":"unicity-aos/aos-ce","slug":"dropped-ingress-message-to-blocked-topic-topic","errorCode":null,"errorMessage":"Dropped ingress message to blocked topic: {topic}","messagePattern":"Dropped ingress message to blocked topic: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"capsules/capsule-cli/src/lib.rs","lineNumber":596,"sourceCode":"    let (Some(topic), Some(payload)) = (\n        msg.get(\"topic\").and_then(|t| t.as_str()),\n        msg.get(\"payload\"),\n    ) else {\n        // No forwardable body, but the principal still binds the connection\n        // (e.g. a bare handshake establishes identity for connect-tracking).\n        // Nothing is forwarded, so the connection's session is never retargeted.\n        log::warn(\"Ingress message has no topic/payload; binding only, nothing forwarded\");\n        return IngressOutcome {\n            newly_bound,\n            session_id: None,\n        };\n    };\n\n    if !is_allowed_ingress_topic(topic) {\n        // A blocked-topic message is neither forwarded nor allowed to retarget\n        // the connection's session — otherwise a client could spoof itself onto\n        // another session's stream with an unforwarded message.\n        log::warn(format!(\"Dropped ingress message to blocked topic: {topic}\"));\n        return IngressOutcome {\n            newly_bound,\n            session_id: None,\n        };\n    }\n\n    // Always forward under the connection's bound principal. There is no\n    // `publish_json` (proxy self-identity) fallback for client traffic:\n    // publishing without a principal would attribute the request to the\n    // proxy capsule's own (admin-seeded) identity, so any socket client\n    // could run admin commands (privilege escalation) — or, if the router\n    // gates on the envelope principal, every admin request would be denied\n    // for lacking one. A bound connection's traffic always attributes to\n    // its principal (auto-attribution for un-stamped messages).\n    if let Err(e) = ipc::publish_json_as(topic, payload, &forward_as) {\n        log::error(format!(\"Failed to publish IPC: {e:?}\"));\n    }\n","sourceCodeStart":578,"sourceCodeEnd":614,"githubUrl":"https://github.com/unicity-aos/aos-ce/blob/f6f22024fb1e8d122f28a1b4a9f75aee448ae839/capsules/capsule-cli/src/lib.rs#L578-L614","documentation":"The message's topic failed is_allowed_ingress_topic, so the library drops it entirely: it is not forwarded AND it does not retarget the connection's session (session_id: None). This blocks a spoofing vector where an unforwarded message could otherwise redirect a connection onto another session's stream.","triggerScenarios":"A client sends an ingress message whose topic is not in the allowed set; the `if !is_allowed_ingress_topic(topic)` check logs this warning and returns IngressOutcome with newly_bound kept but session_id None.","commonSituations":"Clients subscribing to topics that were removed or renamed in the allowlist; typos in topic names; a malicious or buggy client probing internal topics; config changes tightening the ingress allowlist after a deploy.","solutions":["Check the logged topic against is_allowed_ingress_topic / the current allowlist and correct the client's topic name","Update the ingress topic allowlist if this is a legitimate new topic","Upgrade the client if it uses an outdated topic naming scheme","If malicious activity is suspected, investigate the client sending off-allowlist topics"],"exampleFix":"// before\nsend(topic: \"internal/debug-dump\") // blocked\n// after\nsend(topic: \"events\") // allowlisted topic","handlingStrategy":"validation","validationCode":"const ALLOWED: &[&str] = &[\"events\", \"logs\"];\nif !ALLOWED.contains(&msg.topic.as_str()) {\n    return Err(format!(\"topic {} is not allowlisted\", msg.topic));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the client's topic list in sync with is_allowed_ingress_topic","Centralize topic names as constants shared by client and proxy","Review allowlist changes before deploys that restrict topics","Investigate repeated blocked-topic warnings as potential probing/spoofing"],"tags":["ingress","topic","allowlist","security"],"backgroundTag":"permission-denied","analyzedSha":"f6f22024fb1e8d122f28a1b4a9f75aee448ae839","analyzedAt":"2026-09-13T03:04:44.565Z","contentChangedAt":"2026-09-13T03:04:44.565Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}