[PATCH proxmox-firewall] nftables: add support for mark-keyed verdict maps

[Hannes Laimer <h.laimer@proxmox.com>]

nftables sets and maps can be keyed by the packet mark, but the mark
element type has not yet been exposed by proxmox-nftables. A vmap
statement could so far only be parsed, not constructed, so the only ones
in use come from the static ruleset skeleton. Add both to the lib.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 proxmox-nftables/src/statement.rs | 9 +++++++++
 proxmox-nftables/src/types.rs     | 1 +
 2 files changed, 10 insertions(+)

diff --git a/proxmox-nftables/src/statement.rs b/proxmox-nftables/src/statement.rs
index 44a4c48..0416623 100644
--- a/proxmox-nftables/src/statement.rs
+++ b/proxmox-nftables/src/statement.rs
@@ -312,6 +312,15 @@ pub struct Vmap {
     data: Expression,
 }
 
+impl Vmap {
+    pub fn new(key: impl Into<Expression>, data: impl Into<Expression>) -> Self {
+        Self {
+            key: key.into(),
+            data: data.into(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct Match {
     op: Operator,
diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
index 86ccaf8..f79229b 100644
--- a/proxmox-nftables/src/types.rs
+++ b/proxmox-nftables/src/types.rs
@@ -56,6 +56,7 @@ pub enum ElementType {
     Ifname,
     Ipv4Addr,
     Ipv6Addr,
+    Mark,
 }
 proxmox_serde::forward_display_to_serialize!(ElementType);
 
-- 
2.47.3