Re: [PATCH proxmox-firewall] nftables: add support for mark-keyed verdict maps

[Stefan Hanreich <s.hanreich@proxmox.com>]

lgtm

Reviewed-by: Stefan Hanreich <s.hanreich@proxmox.com>

On 8/27/26 3:18 PM, Hannes Laimer wrote:
> nftables sets and maps can be keyed by the packet mark, but the mark
> element type has not yet been exposed by proxmox-nftables. A vmap
> statement could so far only be parsed, not constructed, so the only ones
> in use come from the static ruleset skeleton. Add both to the lib.
> 
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
>  proxmox-nftables/src/statement.rs | 9 +++++++++
>  proxmox-nftables/src/types.rs     | 1 +
>  2 files changed, 10 insertions(+)
> 
> diff --git a/proxmox-nftables/src/statement.rs b/proxmox-nftables/src/statement.rs
> index 44a4c48..0416623 100644
> --- a/proxmox-nftables/src/statement.rs
> +++ b/proxmox-nftables/src/statement.rs
> @@ -312,6 +312,15 @@ pub struct Vmap {
>      data: Expression,
>  }
>  
> +impl Vmap {
> +    pub fn new(key: impl Into<Expression>, data: impl Into<Expression>) -> Self {
> +        Self {
> +            key: key.into(),
> +            data: data.into(),
> +        }
> +    }
> +}
> +
>  #[derive(Clone, Debug, Deserialize, Serialize)]
>  pub struct Match {
>      op: Operator,
> diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
> index 86ccaf8..f79229b 100644
> --- a/proxmox-nftables/src/types.rs
> +++ b/proxmox-nftables/src/types.rs
> @@ -56,6 +56,7 @@ pub enum ElementType {
>      Ifname,
>      Ipv4Addr,
>      Ipv6Addr,
> +    Mark,
>  }
>  proxmox_serde::forward_display_to_serialize!(ElementType);
>