From caba1cd7702c08368ed35a01b0af32629688f1ff Mon Sep 17 00:00:00 2001
From: Tom Eastep <teastep@shorewall.net>
Date: Sat, 20 Feb 2016 10:03:06 -0800
Subject: [PATCH] DOCKER=Yes requires IPTABLES_S

Signed-off-by: Tom Eastep <teastep@shorewall.net>
---
 Shorewall/Perl/Shorewall/Config.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm
index ab0e9d35e..82cf7a808 100644
--- a/Shorewall/Perl/Shorewall/Config.pm
+++ b/Shorewall/Perl/Shorewall/Config.pm
@@ -5861,6 +5861,8 @@ sub get_configuration( $$$$ ) {
     default_yes_no 'WORKAROUNDS'                , 'Yes';
     default_yes_no 'DOCKER'                     , '';
 
+    require_capability( 'IPTABLES_S', 'DOCKER=Yes', 's' ) if $config{DOCKER};
+
     if ( supplied( $val = $config{RESTART} ) ) {
 	fatal_error "Invalid value for RESTART ($val)" unless $val =~ /^(restart|reload)$/;
     } elsif (supplied $config{LEGACY_RESTART} ) {