nixos/wireguard-networkd: fix fwMark type error

nixos/modules/services/networking/wireguard-networkd.nix

@@ -29,6 +29,13 @@ let
 
   escapeCredentialName = input: replaceStrings [ "\\" ] [ "_" ] input;
 
+  fwMarkFromHexOrNum =
+    fwMark:
+    if (lib.hasPrefix "0x" fwMark) then
+      lib.fromHexString fwMark
+    else
+      (builtins.fromTOML "v=${fwMark}").v;
+
   privateKeyCredential = interfaceName: escapeCredentialName "wireguard-${interfaceName}-private-key";
   presharedKeyCredential =
     interfaceName: peer: escapeCredentialName "wireguard-${interfaceName}-${peer.name}-preshared-key";
@@ -52,7 +59,7 @@ let
       wireguardConfig = removeNulls {
         PrivateKey = "@${privateKeyCredential name}";
         ListenPort = interface.listenPort;
-        FirewallMark = interface.fwMark;
+        FirewallMark = if interface.fwMark == null then null else (fwMarkFromHexOrNum interface.fwMark);
         RouteTable = if interface.allowedIPsAsRoutes then interface.table else null;
         RouteMetric = interface.metric;
       };

nixos/tests/wireguard/networkd.nix

@@ -27,6 +27,7 @@ in
               "fc00::1/128"
             ];
             listenPort = 23542;
+            fwMark = "0x6e6978";
 
             # !!! Don't do this with real keys. The /nix store is world-readable!
             privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer0.privateKey);
@@ -60,6 +61,7 @@ in
               "fc00::2/128"
             ];
             listenPort = 23542;
+            fwMark = "30567";
 
             # !!! Don't do this with real keys. The /nix store is world-readable!
             privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey);
@@ -97,5 +99,9 @@ in
     with subtest("Has PSK set"):
       peer0.succeed("wg | grep 'preshared key'")
       peer1.succeed("wg | grep 'preshared key'")
+
+    with subtest("Has FwMark set"):
+      peer0.succeed("wg | grep '0x6e6978'")
+      peer1.succeed("wg | grep '0x7767'")
   '';
 }