@push.rocks/smartnftables 4.0.1 → 4.2.0

package/rust/src/egress.rs

@@ -210,6 +210,67 @@ pub struct HostScope {
     /// bound links. Absent and empty are the same canonical policy.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub local_platform_endpoints: Vec<String>,
+    /// This table is the host's only forwarding owner: every forwarded packet,
+    /// IPv4 or IPv6, that the scope does not admit drops, instead of passing to
+    /// other owners. Absent and false are the same canonical policy.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub exclusive_forwarding: bool,
+}
+/// One leased source port range of one allocation, on the handoff that holds it.
+pub struct LeasedForward<'a> {
+    pub handoff: &'a HostHandoff,
+    pub allocation: &'a Allocation,
+    pub range: &'a PortRange,
+}
+/// One publication, on the handoff link that holds its leased target address.
+pub struct PublishedForward<'a> {
+    pub port: &'a PublishedPort,
+    pub link: &'a LocalLink,
+}
+/// The forwarded flows a host-transit scope admits, in canonical scope order:
+/// leased flows from a handoff to the uplink, and per publication its inbound
+/// flows from the uplink to the handoff and, when symmetric, the flows it opens
+/// from its target ports to the uplink; each with its replies. The scope's nft
+/// forward chain and the Docker contribution both derive from this one list.
+pub struct Forwarding<'a> {
+    pub leased: Vec<LeasedForward<'a>>,
+    pub published: Vec<PublishedForward<'a>>,
+}
+impl HostScope {
+    pub fn forwarding(&self) -> Result<Forwarding<'_>> {
+        let mut leased = Vec::new();
+        for handoff in &self.handoffs {
+            for allocation in &handoff.allocations {
+                for range in &allocation.source_port_ranges {
+                    leased.push(LeasedForward {
+                        handoff,
+                        allocation,
+                        range,
+                    });
+                }
+            }
+        }
+        // Validation admits only leased transit source addresses as targets, and
+        // one address never spans two active handoff links, so each publication
+        // has exactly one handoff.
+        let mut published = Vec::new();
+        for port in &self.published_ports {
+            let handoff =
+                self.handoffs
+                    .iter()
+                    .find(|handoff| {
+                        handoff.allocations.iter().any(|allocation| {
+                            allocation.transit_source_address == port.target_address
+                        })
+                    })
+                    .ok_or(Error::Invalid)?;
+            published.push(PublishedForward {
+                port,
+                link: &handoff.link,
+            });
+        }
+        Ok(Forwarding { leased, published })
+    }
 }
 /// One loopback TCP service that only one local user may dial: packets the host
 /// sends to the exact address and port from a socket of any other user reject,
@@ -1168,6 +1229,9 @@ fn normalize_host(value: &mut HostScope) -> Result<()> {
     )
 }
 
+#[cfg(test)]
+#[path = "egress_exclusiveforwarding_tests.rs"]
+mod exclusiveforwarding_tests;
 #[cfg(test)]
 #[path = "egress_hostgrant_tests.rs"]
 pub(crate) mod hostgrant_tests;

package/rust/src/egress_exclusiveforwarding_tests.rs

@@ -0,0 +1,256 @@
+//! Exclusive forwarding in host transit: the host forwards exactly the scope's
+//! leased, published and symmetric handoff flows, and every other forwarded
+//! packet drops instead of passing to other owners.
+use super::hostgrant_tests::{
+    bytes, chains, decide, normalized, opening, prepared, Flow, ACK, ESTABLISHED,
+};
+use super::tests::{host, pool_guard, published_host, published_port, router};
+use super::Prepared;
+use crate::policy::verdict;
+use serde_json::{json, Value};
+
+const TRANSIT: [u8; 4] = [10, 240, 0, 2];
+const UPLINK: [u8; 4] = [192, 0, 2, 2];
+const PUBLIC: [u8; 4] = [198, 51, 100, 200];
+const CLIENT: [u8; 4] = [198, 51, 100, 9];
+const LAN_PEER: [u8; 4] = [172, 16, 0, 9];
+const HANDOFF: Option<(u32, &str)> = Some((4, "handoff"));
+const UPLINK_LINK: Option<(u32, &str)> = Some((2, "ens18"));
+/// Another host link that no scope binds: a management LAN, a second uplink.
+const LAN: Option<(u32, &str)> = Some((7, "lan0"));
+
+fn exclusive(mut value: Value) -> Value {
+    value["scope"]["exclusiveForwarding"] = json!(true);
+    value
+}
+/// The fixture with one symmetric UDP publication of the transit address.
+fn published() -> Value {
+    let mut port = published_port("udp", 5060, 5060);
+    port["symmetric"] = json!(true);
+    published_host(json!([published_port("tcp", 443, 8443), port]))
+}
+/// One forwarded packet; the originally tracked tuple equals the live one.
+fn forwarded(
+    input: Option<(u32, &'static str)>,
+    output: Option<(u32, &'static str)>,
+    (source, source_port): ([u8; 4], u16),
+    (destination, destination_port): ([u8; 4], u16),
+) -> Flow {
+    Flow {
+        input,
+        output,
+        source,
+        destination,
+        source_port,
+        destination_port,
+        original: (source, destination, source_port, destination_port),
+        ..opening(input, output)
+    }
+}
+/// The answer to `flow` on the reverse links.
+fn answer(flow: Flow) -> Flow {
+    Flow {
+        input: flow.output,
+        output: flow.input,
+        source: flow.destination,
+        destination: flow.source,
+        source_port: flow.destination_port,
+        destination_port: flow.source_port,
+        tcp_flags: ACK,
+        state: ESTABLISHED,
+        reply: true,
+        ..flow
+    }
+}
+/// Forwarded traffic no scope admits: the host as a gateway between its other
+/// links and the uplink, a hairpin back out of the uplink, and traffic between
+/// two links the scope does not bind, in both directions and both protocols.
+fn unadmitted() -> Vec<Flow> {
+    let mut result = Vec::new();
+    for flow in [
+        forwarded(LAN, UPLINK_LINK, (LAN_PEER, 40000), (PUBLIC, 443)),
+        forwarded(UPLINK_LINK, LAN, (CLIENT, 40000), (LAN_PEER, 22)),
+        forwarded(UPLINK_LINK, UPLINK_LINK, (CLIENT, 40000), (PUBLIC, 443)),
+        forwarded(
+            LAN,
+            Some((8, "lan1")),
+            (LAN_PEER, 40000),
+            ([172, 17, 0, 9], 80),
+        ),
+    ] {
+        result.extend([
+            flow,
+            answer(flow),
+            Flow {
+                protocol: 17,
+                ..flow
+            },
+        ]);
+    }
+    result
+}
+/// Every flow the scope forwards: leased TCP and UDP egress with replies,
+/// published inbound TCP and UDP with replies, and symmetric UDP outbound.
+fn admitted() -> Vec<Flow> {
+    let leased = forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 10500), (PUBLIC, 443));
+    let inbound = Flow {
+        original: (CLIENT, UPLINK, 40000, 443),
+        ..forwarded(UPLINK_LINK, HANDOFF, (CLIENT, 40000), (TRANSIT, 8443))
+    };
+    let signalling = Flow {
+        protocol: 17,
+        original: (CLIENT, UPLINK, 40001, 5060),
+        ..forwarded(UPLINK_LINK, HANDOFF, (CLIENT, 40001), (TRANSIT, 5060))
+    };
+    let symmetric = Flow {
+        protocol: 17,
+        ..forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 5060), (CLIENT, 5060))
+    };
+    let mut result = Vec::new();
+    for flow in [
+        leased,
+        Flow {
+            protocol: 17,
+            ..leased
+        },
+        inbound,
+        signalling,
+        symmetric,
+    ] {
+        result.extend([
+            flow,
+            Flow {
+                state: ESTABLISHED,
+                tcp_flags: ACK,
+                ..flow
+            },
+            answer(flow),
+        ]);
+    }
+    result
+}
+
+#[test]
+fn exclusive_forwarding_absent_and_false_keep_the_host_digest_and_compiled_bytes() {
+    let baseline = prepared(host());
+    assert!(!serde_json::to_string(&baseline.policy)
+        .unwrap()
+        .contains("exclusiveForwarding"));
+    let mut value = host();
+    value["scope"]["exclusiveForwarding"] = json!(false);
+    let explicit = prepared(value);
+    assert_eq!(explicit, baseline);
+    assert_eq!(bytes(&explicit), bytes(&baseline));
+    let with = prepared(exclusive(host()));
+    assert_ne!(with.digest, baseline.digest);
+    assert!(serde_json::to_string(&with.policy)
+        .unwrap()
+        .contains("\"exclusiveForwarding\":true"));
+}
+
+#[test]
+fn exclusive_forwarding_appends_one_unconditional_forward_drop_and_nothing_else() {
+    for fixture in [host(), published()] {
+        let baseline = chains(&prepared(fixture.clone()));
+        let with = chains(&prepared(exclusive(fixture)));
+        assert_eq!(
+            with.keys().collect::<Vec<_>>(),
+            baseline.keys().collect::<Vec<_>>()
+        );
+        for (name, rules) in &baseline {
+            if name != "forward" {
+                assert_eq!(&with[name], rules, "{name}");
+            }
+        }
+        // The previous forward rules keep their order and the drop follows them.
+        // It has no family or interface match: forwarded IPv6 and every link
+        // pair drop like forwarded IPv4.
+        let forward = &with["forward"];
+        assert_eq!(&forward[..forward.len() - 1], &baseline["forward"][..]);
+        assert_eq!(forward.last().unwrap(), &vec![verdict(0, None)]);
+    }
+}
+
+#[test]
+fn exclusive_forwarding_denies_every_unadmitted_forward_and_keeps_every_admitted_one() {
+    for fixture in [host(), published()] {
+        let baseline = prepared(fixture.clone());
+        let with = prepared(exclusive(fixture));
+        // Without the member another owner's forwarding passes this table.
+        for (index, flow) in unadmitted().iter().enumerate() {
+            let decision = decide(&baseline, "forward", flow);
+            assert_eq!(
+                (decision.verdict, decision.chain.as_str()),
+                (1, "policy"),
+                "baseline {index}"
+            );
+            let decision = decide(&with, "forward", flow);
+            assert_eq!(
+                (decision.verdict, decision.chain.as_str()),
+                (0, "forward"),
+                "exclusive {index}"
+            );
+        }
+        // Every flow the scope forwards keeps its exact decision, and so does
+        // every handoff flow it already denies.
+        let handoff = [
+            forwarded(HANDOFF, LAN, (TRANSIT, 10500), (LAN_PEER, 443)),
+            forwarded(LAN, HANDOFF, (LAN_PEER, 40000), (TRANSIT, 8443)),
+            forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 9999), (PUBLIC, 443)),
+            forwarded(
+                HANDOFF,
+                UPLINK_LINK,
+                (TRANSIT, 10500),
+                ([10, 250, 0, 2], 443),
+            ),
+        ];
+        for (index, flow) in admitted().iter().chain(&handoff).enumerate() {
+            assert_eq!(
+                decide(&with, "forward", flow),
+                decide(&baseline, "forward", flow),
+                "flow {index}"
+            );
+        }
+    }
+    // The positive controls are real admissions of the published fixture.
+    let published = prepared(exclusive(published()));
+    for (index, flow) in admitted().iter().enumerate() {
+        assert_eq!(
+            decide(&published, "forward", flow).verdict,
+            1,
+            "admitted {index}"
+        );
+    }
+}
+
+#[test]
+fn exclusive_forwarding_without_handoffs_forwards_nothing() {
+    let mut value = exclusive(host());
+    value["scope"]["handoffs"] = json!([]);
+    let empty = prepared(value);
+    assert_eq!(chains(&empty)["forward"], vec![vec![verdict(0, None)]]);
+    let leased = forwarded(HANDOFF, UPLINK_LINK, (TRANSIT, 10500), (PUBLIC, 443));
+    for flow in unadmitted().into_iter().chain([leased, answer(leased)]) {
+        assert_eq!(decide(&empty, "forward", &flow).verdict, 0);
+    }
+    // Without the member an empty scope forwards everything, as before.
+    let mut value = host();
+    value["scope"]["handoffs"] = json!([]);
+    let open = prepared(value);
+    assert!(chains(&open)["forward"].is_empty());
+    assert_eq!(decide(&open, "forward", &leased).verdict, 1);
+}
+
+#[test]
+fn exclusive_forwarding_is_a_host_transit_boolean_only() {
+    for fixture in [router(), pool_guard()] {
+        assert!(normalized(exclusive(fixture)).is_err());
+    }
+    for invalid in [json!(1), json!("true"), json!(null)] {
+        let mut value = host();
+        value["scope"]["exclusiveForwarding"] = invalid;
+        assert!(normalized(value).is_err());
+    }
+    let restored: Prepared = prepared(exclusive(host()));
+    assert_eq!(restored.clone().policy.prepare().unwrap(), restored);
+}

package/rust/src/forwardhooks.rs

@@ -0,0 +1,176 @@
+//! Read-only view of every packet-filter owner on the IPv4/IPv6 forward hook of
+//! this network namespace. It claims, adopts and changes nothing.
+use crate::wire::{self, Attr, Socket};
+use crate::{decode, encode, Error, Request, Result};
+use serde::Serialize;
+
+#[cfg(test)]
+#[path = "forwardhooks_tests.rs"]
+mod tests;
+
+/// One nf_tables base chain on the forward hook.
+#[derive(Clone, Debug, Serialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "camelCase")]
+pub struct Chain {
+    pub family: &'static str,
+    pub table: String,
+    pub table_handle: String,
+    pub chain: String,
+    #[serde(rename = "type")]
+    pub chain_type: String,
+    pub priority: i32,
+    pub policy: &'static str,
+}
+/// Docker's iptables-nft dispatch chains in table `ip filter`.
+#[derive(Clone, Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct Docker {
+    pub docker_user: bool,
+    pub docker_forward: bool,
+}
+/// Registered legacy xtables tables. Their hooks, including FORWARD, are not
+/// nf_tables objects and never appear in `chains`.
+#[derive(Clone, Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct Legacy {
+    pub ipv4: Vec<String>,
+    pub ipv6: Vec<String>,
+}
+#[derive(Clone, Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct Inspection {
+    pub chains: Vec<Chain>,
+    pub docker: Docker,
+    pub legacy_tables: Legacy,
+}
+
+/// The families whose forward hook sees routed IPv4 or IPv6 packets.
+fn family(value: u8) -> Option<&'static str> {
+    match value {
+        1 => Some("inet"),
+        2 => Some("ip"),
+        10 => Some("ip6"),
+        _ => None,
+    }
+}
+const NF_INET_FORWARD: u32 = 2;
+
+/// Classify one consistent table and chain dump.
+pub(crate) fn classify(
+    tables: &[(u8, Vec<Attr>)],
+    chains: &[(u8, Vec<Attr>)],
+) -> Result<(Vec<Chain>, Docker)> {
+    let mut result = Vec::new();
+    let mut docker = Docker {
+        docker_user: false,
+        docker_forward: false,
+    };
+    for (number, attributes) in chains {
+        let table = wire::text(attributes, 1)?;
+        let name = wire::text(attributes, 3)?;
+        if *number == 2 && table == "filter" {
+            match name.as_str() {
+                "DOCKER-USER" => docker.docker_user = true,
+                "DOCKER-FORWARD" => docker.docker_forward = true,
+                _ => {}
+            }
+        }
+        let Some(family) = family(*number) else {
+            continue;
+        };
+        // Only base chains carry a hook.
+        if !attributes.iter().any(|attribute| attribute.id() == 4) {
+            continue;
+        }
+        let hook = wire::attrs(&wire::one(attributes, 4)?.value)?;
+        if wire::number(&hook, 1)? != NF_INET_FORWARD {
+            continue;
+        }
+        let priority = wire::number(&hook, 2)? as i32;
+        let policy = match wire::number(attributes, 5)? {
+            0 => "drop",
+            1 => "accept",
+            _ => return Err(Error::Protocol),
+        };
+        let handle = tables
+            .iter()
+            .filter(|(owner, table_attributes)| {
+                owner == number
+                    && wire::text(table_attributes, 1).ok().as_deref() == Some(table.as_str())
+            })
+            .map(|(_, table_attributes)| wire::handle(table_attributes, 4))
+            .collect::<Result<Vec<_>>>()?;
+        let [handle] = handle.as_slice() else {
+            return Err(Error::Conflict);
+        };
+        result.push(Chain {
+            family,
+            table,
+            table_handle: handle.to_string(),
+            chain: name,
+            chain_type: wire::text(attributes, 7)?,
+            priority,
+            policy,
+        });
+    }
+    result.sort();
+    Ok((result, docker))
+}
+
+/// One registered table name per line; an absent file means none is registered.
+fn legacy(path: &str) -> Result<Vec<String>> {
+    use std::io::Read;
+    let file = match std::fs::File::open(path) {
+        Ok(file) => file,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(_) => return Err(Error::Unavailable),
+    };
+    let mut text = String::new();
+    file.take(4097)
+        .read_to_string(&mut text)
+        .map_err(|_| Error::Protocol)?;
+    if text.len() > 4096 {
+        return Err(Error::Protocol);
+    }
+    let mut names = Vec::new();
+    for line in text.lines() {
+        if !crate::policy::identifier(line) {
+            return Err(Error::Protocol);
+        }
+        names.push(line.to_owned());
+    }
+    names.sort();
+    Ok(names)
+}
+
+pub fn inspect() -> Result<Inspection> {
+    let mut socket = Socket::open()?;
+    let generation = socket.generation()?;
+    let tables = socket.dump_all_families(1)?;
+    let chains = socket.dump_all_families(4)?;
+    // Both dumps describe one ruleset generation, or the view is inconclusive.
+    if socket.generation()? != generation {
+        return Err(Error::Conflict);
+    }
+    let (chains, docker) = classify(&tables, &chains)?;
+    Ok(Inspection {
+        chains,
+        docker,
+        legacy_tables: Legacy {
+            ipv4: legacy("/proc/self/net/ip_tables_names")?,
+            ipv6: legacy("/proc/self/net/ip6_tables_names")?,
+        },
+    })
+}
+
+pub fn dispatch(request: Request) -> Result<serde_json::Value> {
+    match request.method.as_str() {
+        "inspectForwardHooks" => {
+            if decode::<serde_json::Value>(request.params)? != serde_json::json!({}) {
+                return Err(Error::Invalid);
+            }
+            encode(inspect()?)
+        }
+        _ => Err(Error::Invalid),
+    }
+}

package/rust/src/forwardhooks_tests.rs

@@ -0,0 +1,136 @@
+use super::*;
+
+fn table(family: u8, name: &str, handle: u64) -> (u8, Vec<Attr>) {
+    (family, vec![Attr::string(1, name), Attr::u64(4, handle)])
+}
+fn base(
+    family: u8,
+    table: &str,
+    name: &str,
+    hook: u32,
+    priority: i32,
+    policy: u32,
+) -> (u8, Vec<Attr>) {
+    let hook = Attr::nested(
+        4,
+        vec![
+            Attr::bytes(1, hook.to_be_bytes().to_vec()),
+            Attr::bytes(2, priority.to_be_bytes().to_vec()),
+        ],
+    );
+    (
+        family,
+        vec![
+            Attr::string(1, table),
+            Attr::string(3, name),
+            hook,
+            Attr::bytes(5, policy.to_be_bytes().to_vec()),
+            Attr::string(7, "filter"),
+        ],
+    )
+}
+fn regular(family: u8, table: &str, name: &str) -> (u8, Vec<Attr>) {
+    (family, vec![Attr::string(1, table), Attr::string(3, name)])
+}
+
+#[test]
+fn forward_hooks_report_every_routed_forward_base_chain_with_its_table() {
+    let tables = [
+        table(1, "snft_host", 7),
+        table(2, "filter", 3),
+        table(10, "filter", 4),
+        table(7, "filter", 5),
+        table(5, "edge", 6),
+        table(1, "other", 8),
+    ];
+    let chains = [
+        base(1, "snft_host", "forward", 2, 0, 1),
+        base(1, "snft_host", "input", 1, 0, 1),
+        base(2, "filter", "FORWARD", 2, 0, 0),
+        regular(2, "filter", "DOCKER-USER"),
+        regular(2, "filter", "DOCKER-FORWARD"),
+        base(10, "filter", "FORWARD", 2, 0, 1),
+        // Bridge and netdev hooks do not see routed packets.
+        base(7, "filter", "FORWARD", 2, -200, 0),
+        base(5, "edge", "ingress", 0, -500, 1),
+        base(1, "other", "early", 2, -150, 0),
+    ];
+    let (chains, docker) = classify(&tables, &chains).unwrap();
+    let summary: Vec<_> = chains
+        .iter()
+        .map(|c| {
+            (
+                c.family,
+                c.table.as_str(),
+                c.table_handle.as_str(),
+                c.chain.as_str(),
+                c.priority,
+                c.policy,
+            )
+        })
+        .collect();
+    assert_eq!(
+        summary,
+        vec![
+            ("inet", "other", "8", "early", -150, "drop"),
+            ("inet", "snft_host", "7", "forward", 0, "accept"),
+            ("ip", "filter", "3", "FORWARD", 0, "drop"),
+            ("ip6", "filter", "4", "FORWARD", 0, "accept"),
+        ]
+    );
+    assert_eq!(
+        docker,
+        Docker {
+            docker_user: true,
+            docker_forward: true
+        }
+    );
+    let json = serde_json::to_value(&chains[0]).unwrap();
+    assert_eq!(
+        json,
+        serde_json::json!({"family":"inet","table":"other","tableHandle":"8","chain":"early",
+        "type":"filter","priority":-150,"policy":"drop"})
+    );
+}
+
+#[test]
+fn forward_hooks_report_absent_docker_chains_and_reject_inconsistent_dumps() {
+    let (chains, docker) = classify(
+        &[],
+        &[
+            regular(10, "filter", "DOCKER-USER"),
+            regular(2, "nat", "DOCKER-FORWARD"),
+        ],
+    )
+    .unwrap();
+    assert!(chains.is_empty());
+    assert_eq!(
+        docker,
+        Docker {
+            docker_user: false,
+            docker_forward: false
+        }
+    );
+    // A base chain whose table the table dump does not hold exactly once.
+    let chain = [base(2, "filter", "FORWARD", 2, 0, 0)];
+    assert_eq!(classify(&[], &chain), Err(Error::Conflict));
+    assert_eq!(
+        classify(&[table(2, "filter", 1), table(2, "filter", 2)], &chain),
+        Err(Error::Conflict)
+    );
+    assert_eq!(
+        classify(
+            &[table(2, "filter", 1)],
+            &[base(2, "filter", "FORWARD", 2, 0, 3)]
+        ),
+        Err(Error::Protocol)
+    );
+}
+
+#[test]
+fn forward_hooks_read_absent_legacy_tables_as_none() {
+    assert_eq!(
+        legacy("/proc/self/net/smartnftables-absent-fixture").unwrap(),
+        Vec::<String>::new()
+    );
+}

package/rust/src/main.rs

@@ -1,5 +1,6 @@
 mod egress;
 mod docker;
+mod forwardhooks;
 mod managed;
 mod namespace;
 mod owner;
@@ -172,14 +173,12 @@ fn failure(id: &str, error: Error) -> serde_json::Value {
 
 fn main() {
     let arguments = std::env::args().skip(1).collect::<Vec<_>>();
-    let (docker_mode, descriptor) = match arguments.as_slice() {
-        [management] if management == "--management" => (false, None),
-        [management] if management == "--docker-forwarding" => (true, None),
-        [management, option, fd]
-            if (management == "--management" || management == "--docker-forwarding") && option == "--network-namespace-fd" =>
-        {
+    const MODES: [&str; 3] = ["--management", "--docker-forwarding", "--forward-hooks"];
+    let (mode, descriptor) = match arguments.as_slice() {
+        [mode] if MODES.contains(&mode.as_str()) => (mode.clone(), None),
+        [mode, option, fd] if MODES.contains(&mode.as_str()) && option == "--network-namespace-fd" => {
             match fd.parse::<i32>() {
-                Ok(value) => (management == "--docker-forwarding", Some(value)),
+                Ok(value) => (mode.clone(), Some(value)),
                 Err(_) => std::process::exit(2),
             }
         }
@@ -217,7 +216,12 @@ fn main() {
             std::process::exit(2);
         }
         let id = request.id.clone();
-        let response = match if docker_mode { docker::dispatch(&mut docker, request) } else { dispatch(&mut owner, request) } {
+        let result = match mode.as_str() {
+            "--docker-forwarding" => docker::dispatch(&mut docker, request),
+            "--forward-hooks" => forwardhooks::dispatch(request),
+            _ => dispatch(&mut owner, request),
+        };
+        let response = match result {
             Ok(result) => serde_json::json!({"id":id,"success":true,"result":result}),
             Err(error) => failure(&id, error),
         };