v0.2.10

shorewall-nft 0.2.10 makes INCLUDE resolve files through CONFIG_PATH, and points the systemd units at the binary's real install path. Both came from users checking the compiler and the packages against real setups.

CONFIG_PATH

An INCLUDE or ?INCLUDE directive now resolves a bare file name through the directories in CONFIG_PATH, matching upstream. A rules file can say ?INCLUDE DMZ.rules and have it found in a rules.d directory listed in CONFIG_PATH, the way it worked under Shorewall on iptables. The file is still looked for next to the including file first, so every relative include keeps working. Only a name that is not found there, and that has no directory part, falls back to the CONFIG_PATH search. A name with a slash in it is taken as written. CONFIG_PATH was ignored before, so an include written this way failed to resolve.

systemd units on a unified /usr

The systemd units call the firewall binary at the path it installs to, taken from SBINDIR, instead of hardcoding /usr/sbin. On Debian that is still /usr/sbin, so the units do not change. On Fedora 42 and later, where /usr/sbin is a symlink into /usr/bin and the binary installs to /usr/bin, the units now name /usr/bin/shorewall and keep working if the /usr/sbin compatibility symlink is ever removed. The rpm build checks that the binary named by ExecStart exists.