egress anti-spoof: back to log by default; the lease set does not survive a suspend/resume

nix/host-modules/hive-egress.nix

@@ -339,7 +339,7 @@ in
       "drop"
       "log"
     ];
-    default = "drop";
+    default = "log";
     description = ''
       What the `bridge hive_egress` table does with a frame whose source is not
       the sending container's own. Every port of the agent bridge is checked:
@@ -350,13 +350,15 @@ in
       address whose `chaddr` is the port's MAC, ARP probes, and IPv6 link-local
       sources (and `::` in neighbour discovery and listener reports).
 
-      - `drop` (the default): the frame is dropped and logged with the prefix
+      - `drop`: the frame is dropped and logged with the prefix
         `hive-egress-spoof `, rate limited per port. A packet the per-port limit
         cannot log gets a line with the prefix `hive-egress-spoof-unmetered `
         from a limit shared by all ports. A container sending from its leased
         address is never affected, so nothing legitimate breaks.
-      - `log`: the same lines and counters, and the frame goes through. For
-        finding out whether a suspected false positive of `drop` is one.
+      - `log` (the default): the same lines and counters, and the frame goes
+        through. For finding out why a legitimate container is refused on a
+        live hive. It is the default because the lease set does not yet survive
+        a host suspend/resume; `drop` returns once a resume test proves it.
 
       With `log`, the identity squid takes from the source of an intercepted
       flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.

nix/module-eval/core-toggle.nix

@@ -73,19 +73,19 @@ let
   # The two settings of `egress.forward` the ordinary host (`log`) does not
   # render, for ../host-modules/hive-egress.nix: `accept` leaves the table
   # without a forward chain, `reject` renders the chain that refuses. The
-  # `accept` host also sets `egress.antiSpoof = "log"`, the one setting the
-  # ordinary host (`drop`) does not render.
+  # `accept` host also sets `egress.antiSpoof = "drop"`, the one setting the
+  # ordinary host (`log`) does not render.
   egressForwardAccept = hive {
     network.enable = true;
     deploy.hive-controller.egress.forward = "accept";
-    deploy.hive-controller.egress.antiSpoof = "log";
+    deploy.hive-controller.egress.antiSpoof = "drop";
   };
   # The same two settings under their old names, `network.egress.*`, which
   # `deploy.nix` still renames.
   egressForwardAcceptLegacy = hive {
     network.enable = true;
     network.egress.forward = "accept";
-    network.egress.antiSpoof = "log";
+    network.egress.antiSpoof = "drop";
   };
   egressForwardReject = hiveWithController {
     deploy.hive-controller.egress.forward = "reject";
@@ -1639,17 +1639,17 @@ let
       # its own, and logs it. The ruleset is read as text: the spoof chain
       # ends every path in `drop`, and the accepts that remain are the ones that
       # let the leased source through, which is the presence arm.
-      name = "egress.antiSpoof defaults to drop and renders the bridge table that drops frames whose source is not the port's own";
+      name = "egress.antiSpoof drop renders the bridge table that drops frames whose source is not the port's own";
       ok =
         let
-          text = bare.services.hyperhive.network.egress.ruleset;
+          text = egressForwardAccept.services.hyperhive.network.egress.ruleset;
           bridgeText = lib.last (lib.splitString "table bridge hive_egress" text);
           section =
             name: lib.head (lib.splitString "chain" (lib.last (lib.splitString "chain ${name} {" bridgeText)));
           spoof = lib.filter (l: l != "" && l != "}") (map lib.trim (lib.splitString "\n" (section "spoof")));
           ip4 = section "l3_v4";
         in
-        bare.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "drop"
+        egressForwardAccept.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "drop"
         && lib.hasInfix "hook prerouting priority -300" bridgeText
         && lib.hasInfix ''meta ibrname != "hive-br0" accept'' bridgeText
         && lib.hasInfix "iifname . ether saddr != @port_mac goto spoof" bridgeText
@@ -1666,10 +1666,10 @@ let
         && lib.hasInfix "goto spoof" ip4;
     }
     {
-      # `log` renders the same chains with `accept` where `drop`
+      # `log`, the default, renders the same chains with `accept` where `drop`
       # was: the lines and counters stay, the frame goes through. The `accept`
-      # host sets `log` and `bare` is the control that the two differ.
-      name = "egress.antiSpoof log renders the spoof chain with accept and no drop";
+      # host sets `drop` and is the control that the two differ.
+      name = "egress.antiSpoof defaults to log and renders the spoof chain with accept and no drop";
       ok =
         let
           textOf = m: m.services.hyperhive.network.egress.ruleset;
@@ -1681,14 +1681,14 @@ let
             lib.filter (l: l != "" && l != "}") (
               map lib.trim (lib.splitString "\n" (lib.head (lib.splitString "chain" t)))
             );
-          logged = spoofOf egressForwardAccept;
+          logged = spoofOf bare;
         in
-        egressForwardAccept.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "log"
+        bare.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "log"
         && lib.length logged == 3
         && lib.all (l: lib.hasSuffix " accept" l) logged
-        && lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf egressForwardAccept)
+        && lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf bare)
         && !(lib.any (l: lib.hasSuffix " drop" l) logged)
-        && lib.all (l: lib.hasSuffix " drop" l) (spoofOf bare);
+        && lib.all (l: lib.hasSuffix " drop" l) (spoofOf egressForwardAccept);
     }
     {
       # The sets are filled at run time, from four places: the unit at start and