1)  On systems running Upstart, shorewall-init cannot reliably secure
    the firewall before interfaces are brought up.

2)  The Shorewall Init installer (install.sh) fails on Gentoo systems.

    Corrected in Shorewall 4.5.21.1.

3)  The installers (install.sh) fail to start the products at boot time
    on Debian and derivatives. This problem was introduced in Shorewall
    4.5.21.

    Corrected in Shorewall 4.5.21.1.

4)  Multiple ICMP/ICMP6 types listed in a rule result in a Perl runtime
    error on the compiler.

    Corrected in Shorewall 4.5.21.1.

5)  An attempt to specify RAS or Q.931 in the HELPER column is rejected
    with an error.

    Corrected in Shorewall 4.5.21.1.

6) The 'nohostroute' provider option does not suppress the addition of
   a host route in the default routing table when USE_DEFAULT_RT=Yes.

   Corrected in Shorewall 4.5.21.1.

7)  The AutoBL action fails if the kernel and iptables does not support
    the Recent Match '--reap' option.

    Corrected in Shorewall 4.5.21.2.

8)  The Shorewall-core installer reports an error from 'cp'
    stating that it can not stat the shorewallrc file.

    Workaround: Run the installer a second time.

    Corrected in Shorewall 4.5.21.2.

9)  When a non-root user attempts to execute 'version -a', the CLI
    attempts to get the version of the compiled firewall resulting in
    the following diagnostic when run by non-root:

    	 /sbin/shorewall: /var/lib/shorewall/firewall: Permission denied

    Corrected in Shorewall 4.5.21.2.

10) Shorewall uses 'fgrep' making it unusable on on systems without
    that utility.

    Corrected in Shorewall 4.5.21.2.

11) Placing |<mark> in the ACTION column of the tcrules file raises a
    fatal compilation error. 

    Corrected in Shorewall 4.5.21.2.

12) The Shorewall-core installer fails when run on Ubuntu Raring.

    Corrected in Shorewall 4.5.21.2.

13) The Shorewall-init installer fails when run on Ubuntu Raring.

    Workaround: Run as follows:

    	BUILD=debian ./install.sh

    Corrected in Shorewall 4.5.21.3.

14) The tarball installers don't run update-rc.d on Debian-based
    systems without insserv.

    Corrected in Shorewall 4.5.21.3.

15) If an HFSC class is specified with dmax but not umax, then
    the firewall fails to start with the messages:

      Nov 14 13:42:42 Setting up Traffic Control...
      HFSC: Illegal "umax"
      HFSC: Illegal "sc"
      ERROR: Command "tc class add dev eth1 parent 1:1 classid 1:110 hfsc sc
         umax b dmax 150ms rate 1575kbit ul rate 3150kbit" Failed

    Workaround: Specify a umax value equal to the device MTU.

    Corrected in Shorewall 4.5.21.4.
