1)  On systems running Upstart, shorewall-init cannot reliably secure
    the firewall before interfaces are brought up.

2)  The 'enable', 'reenable' and 'disable' commands do not work
    correctly in configurations with USE_DEFAULT_RT=No and optional
    providers listed in the DUPLICATE column.

3)  While the 'ip' utility now accepts IPv6 routes with multiple
    'nexthop' destinations, these routes are not balanced. They are
    rather instantiated as a sequence of single routes with different
    metrics.  Furthermore,  the 'ip route replace' command fails on
    such routes. Beginning with Shorewall6 5.0.15, the generated script
    uses a "delete..add.." sequence on these routes rather than a
    single "replace" command.

4)  Compiled Shorewall firewall scripts containe code that
    confuse emacs when the scripts are viewed in shell mode.

    Corrected in Shorewall 5.2.1.1.

5)  If ip6tables-restore fails during Shorewall6 start, restart or
    reload, the resulting error message indicates that iptables-restore
    failed.

    Corrected in Shorewall 5.2.1.1.

6)  Setting Docker=Yes does not work correctly with Docker version
    18.03.1-ce.

    Corrected in Shorewall 5.2.1.1.

7)  If there are multiple 'balance' providers and more than one of them
    has experienced carrier loss, then enable and disable operations
    may fail.

    Corrected in Shorewall 5.2.1.1.

8)  The fix for DOCKER=Yes in 5.2.1.1 inadvertantly results in an
    assertion failure when processing a 'check -r' command when
    DOCKER=Yes.

    Corrected in Shorewall 5.2.1.2.

9)  When the HELPER target is used with an empty HELPER column, the
    error message produced incorrectly reads:

    	  ERROR: HELPER require requires that ...

    Corrected in Shorewall 5.2.1.2.

10)  On Centos 7, the following journal message appears when Shorewall
    attempts to load kernel modules:

      nf_log: can't load ipt_ULOG, conflicting nfnetlink_log already
              loaded

    Corrected in Shorewall 5.2.1.2.

11) If a configuration has optional interfaces but no providers, the
    'status -i' command fails to reliably report interface status.

    Corrected in Shorewall 5.2.1.3.

12) A change in 5.2.0.5 that corrected an ip[6]tables error in the
    UNTRACKED section of the rules file, changed the name of the chain
    used to hold UNTRACKED rules. Previously, the chain was named
    &z1-z2, where 'z1' is the source zone and 'z2' is the
    destination; after the change, the chain is named
    =z1-z2. Unfortunately, log messages generated out of these chains
    still refer to &z1-z2

    Corrected in Shorewall 5.2.1.4.

13) When the RATE column contains both a source and destination rate,
    it is currently not possible to specify a netmask on either rate.
    Attempting to do so results in:

       ERROR: Invalid rate (...)
       
    Corrected in Shorewall 5.2.1.4.
