1)  On systems running Upstart, shorewall-init cannot reliably secure
    the firewall before interfaces are brought up.

2)  The 'enable', 'reenable' and 'disable' commands do not work
    correctly in configurations with USE_DEFAULT_RT=No and optional
    providers listed in the DUPLICATE column.

3)  The SSDPServer macro released in 5.1.12 is incorrect:

    - It inadvertently contains the content of macro SSDP.
    - It fails to follow the standard naming convention (should be
      SSDPserver (lower case 's' in 'server').

    The correct macro.SSDPserver has the following content:

#
# Shorewall -- /usr/share/shorewall/macro.SSDPserver
#
# This macro handles SSDP (used by DLNA/UPnP) server bidirectional traffic.
#
###############################################################################
#ACTION SOURCE  DEST    PROTO   DPORT   SPORT   ORIGDEST        RATE    USER

PARAM   -       -       udp     1900
PARAM   DEST    SOURCE  udp     -       1900

    Corrected in Shorewall 5.1.12.1.

4)  When double semicolons (";;") are used to introduce inline
    matches, column/value pairs enclosed in braces ("{...}") are not
    recongnized correctly if there is any white space between the
    closing brace ("}") and the semicolons.

    Workaround: Avoid white space between "}" and ";;"

    Corrected in Shorewall 5.1.12.1

5)  The 5.1.12 change that emits warnings when INLINE_MATCHES=Yes does
    not issue a warning when a single semicolon is used to introduce
    inline matches in INLINE, IPTABLES and IP6TABLES rules.

    Corrected in Shorewall 5.1.12.2.

6)  If a policy action specification in shorewall[6].conf
    or in the policy file includes a log tag, a garbled error message
    is issued.

    Corrected in Shorewall 5.1.12.2.

7)  Under rare rare circumstances, syn flood limiting specified in a
    policy is not enforced by the generated ruleset.

    Corrected in Shorewall 5.1.12.2.

8)  The Shorewall[6][-lite] lock file is not always released when an
    error occurs, resulting in:

    - A warning message saying that a stale lock file has been removed
    - 'lock' processes remaining after shorewall[6][-lite] terminated
      (only reported on OpenWRT).

    Corrected in Shorewall 5.1.12.3.

9)  When 'reset' and 'dst' are specified to the IfEvent action,
    the action incorrectly attempts to reset the event for the
    SOURCE IP address rather than the DEST address.

    Corrected in Shorewall 5.1.12.4.
