[PATCH proxmox-firewall] nftables: add support for mark-keyed verdict maps

[PATCH proxmox-firewall] nftables: add support for mark-keyed verdict maps

[Hannes Laimer]

nftables sets and maps can be keyed by the packet mark, but the mark
element type has not yet been exposed by proxmox-nftables. A vmap
statement could so far only be parsed, not constructed, so the only ones
in use come from the static ruleset skeleton. Add both to the lib.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 proxmox-nftables/src/statement.rs | 9 +++++++++
 proxmox-nftables/src/types.rs     | 1 +
 2 files changed, 10 insertions(+)

diff --git a/proxmox-nftables/src/statement.rs b/proxmox-nftables/src/statement.rs
index 44a4c48..0416623 100644
--- a/proxmox-nftables/src/statement.rs
+++ b/proxmox-nftables/src/statement.rs
@@ -312,6 +312,15 @@ pub struct Vmap {
     data: Expression,
 }
 
+impl Vmap {
+    pub fn new(key: impl Into<Expression>, data: impl Into<Expression>) -> Self {
+        Self {
+            key: key.into(),
+            data: data.into(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct Match {
     op: Operator,
diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
index 86ccaf8..f79229b 100644
--- a/proxmox-nftables/src/types.rs
+++ b/proxmox-nftables/src/types.rs
@@ -56,6 +56,7 @@ pub enum ElementType {
     Ifname,
     Ipv4Addr,
     Ipv6Addr,
+    Mark,
 }
 proxmox_serde::forward_display_to_serialize!(ElementType);
 
-- 
2.47.3

Re: [PATCH proxmox-firewall] nftables: add support for mark-keyed verdict maps

[Stefan Hanreich]

lgtm

Reviewed-by: Stefan Hanreich <s.hanreich@proxmox.com>

On 8/27/26 3:18 PM, Hannes Laimer wrote:
> nftables sets and maps can be keyed by the packet mark, but the mark
> element type has not yet been exposed by proxmox-nftables. A vmap
> statement could so far only be parsed, not constructed, so the only ones
> in use come from the static ruleset skeleton. Add both to the lib.
> 
> Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
> ---
>  proxmox-nftables/src/statement.rs | 9 +++++++++
>  proxmox-nftables/src/types.rs     | 1 +
>  2 files changed, 10 insertions(+)
> 
> diff --git a/proxmox-nftables/src/statement.rs b/proxmox-nftables/src/statement.rs
> index 44a4c48..0416623 100644
> --- a/proxmox-nftables/src/statement.rs
> +++ b/proxmox-nftables/src/statement.rs
> @@ -312,6 +312,15 @@ pub struct Vmap {
>      data: Expression,
>  }
>  
> +impl Vmap {
> +    pub fn new(key: impl Into<Expression>, data: impl Into<Expression>) -> Self {
> +        Self {
> +            key: key.into(),
> +            data: data.into(),
> +        }
> +    }
> +}
> +
>  #[derive(Clone, Debug, Deserialize, Serialize)]
>  pub struct Match {
>      op: Operator,
> diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
> index 86ccaf8..f79229b 100644
> --- a/proxmox-nftables/src/types.rs
> +++ b/proxmox-nftables/src/types.rs
> @@ -56,6 +56,7 @@ pub enum ElementType {
>      Ifname,
>      Ipv4Addr,
>      Ipv6Addr,
> +    Mark,
>  }
>  proxmox_serde::forward_display_to_serialize!(ElementType);
>  

applied: [PATCH proxmox-firewall] nftables: add support for mark-keyed verdict maps

[Thomas Lamprecht]

On Thu, 27 Aug 2026 15:17:56 +0200, Hannes Laimer wrote:
> nftables sets and maps can be keyed by the packet mark, but the mark
> element type has not yet been exposed by proxmox-nftables. A vmap
> statement could so far only be parsed, not constructed, so the only ones
> in use come from the static ruleset skeleton. Add both to the lib.

Applied, thanks!

[1/1] nftables: add support for mark-keyed verdict maps
      commit: f558dc863dd2ac072438d4cc655a7033fcae67fb