Repository: istio/istio
File: tools/istio-iptables/pkg/dependencies/implementation.go (Go)

Code before:
		nftBin = iptablesNftBin
		legacyBin = iptablesLegacyBin
		plainBin = iptablesBin
	}

	// the user has specifically chosen an iptables
	// version so use that binary or fail
	if r.ForceIptablesBinary != "" {
		switch r.ForceIptablesBinary {
		case legacy:
			legVer, err := shouldUseBinaryForContext(legacyBin)
			if err != nil {
				log.Errorf("did not find iptables binary, error was %v: %+v", err, legVer)
				return IptablesVersion{}, err
			}
			return legVer, nil
		case nft:
			nftVer, err := shouldUseBinaryForContext(nftBin)
			if err != nil {
				log.Errorf("did not find iptables binary, error was %v: %+v", err, nftVer)
				return IptablesVersion{}, err
			}
			return nftVer, nil
		default:
			log.Errorf("iptables binary unsupported: %s, supported values are 'legacy' or 'nft'", r.ForceIptablesBinary)
			return IptablesVersion{}, fmt.Errorf("iptables binary unsupported")
		}
	}

	// 1. What binaries we have
	// 2. What binary we should use, based on existing rules defined in our current context.
	//
	// does the legacy binary set exist, and are legacy rules present?
	legVer, err := shouldUseBinaryForContext(legacyBin)
	if err == nil && legVer.ExistingRules {
		// if so, immediately use it
		return legVer, nil
	}
	// not critical, may find another.
	log.Debugf("did not find (or cannot use) iptables binary, error was %v: %+v", err, legVer)

	// Check again
	// does the nft binary set exist and seem usable?
	// (at this point we don't need to check for existing rules,
	// since we know legacy doesn't have any, and `nft` is usable, prefer `nft`)
	nftVer, err := shouldUseBinaryForContext(nftBin)
	if err == nil {
		// if so, immediately use it.
		return nftVer, nil
	}
	// not critical, may find another.

Review comment (suggestion):
Along with the error message, lets print the value of r.ForceIptablesBinary

```suggestion
			return IptablesVersion{}, fmt.Errorf("iptables binary %q unsupported", r.ForceIptablesBinary)
```

Code after:
		nftBin = iptablesNftBin
		legacyBin = iptablesLegacyBin
		plainBin = iptablesBin
	}

	// the user has specifically chosen an iptables
	// version so use that binary or fail
	if r.ForceIptablesBinary != "" {
		switch r.ForceIptablesBinary {
		case legacy:
			legVer, err := shouldUseBinaryForContext(legacyBin)
			if err != nil {
				log.Errorf("did not find iptables binary, error was %v: %+v", err, legVer)
				return IptablesVersion{}, err
			}
			return legVer, nil
		case nft:
			nftVer, err := shouldUseBinaryForContext(nftBin)
			if err != nil {
				log.Errorf("did not find iptables binary, error was %v: %+v", err, nftVer)
				return IptablesVersion{}, err
			}
			return nftVer, nil
		default:
			log.Errorf("iptables binary unsupported: %s, supported values are 'legacy' or 'nft'", r.ForceIptablesBinary)
			return IptablesVersion{}, fmt.Errorf("iptables binary %q unsupported", r.ForceIptablesBinary)
		}
	}

	// 1. What binaries we have
	// 2. What binary we should use, based on existing rules defined in our current context.
	//
	// does the legacy binary set exist, and are legacy rules present?
	legVer, err := shouldUseBinaryForContext(legacyBin)
	if err == nil && legVer.ExistingRules {
		// if so, immediately use it
		return legVer, nil
	}
	// not critical, may find another.
	log.Debugf("did not find (or cannot use) iptables binary, error was %v: %+v", err, legVer)

	// Check again
	// does the nft binary set exist and seem usable?
	// (at this point we don't need to check for existing rules,
	// since we know legacy doesn't have any, and `nft` is usable, prefer `nft`)
	nftVer, err := shouldUseBinaryForContext(nftBin)
	if err == nil {
		// if so, immediately use it.
		return nftVer, nil
	}
	// not critical, may find another.