connectivity: introduce host firewall tests

Introduce two new tests covering the host firewall functionality, i.e.,
asserting that both ingress and egress CiliumClusterwideNetworkPolicies
specifying a NodeSelector correctly block the expected traffic. The
tests are executed only when the unsafe tests are enabled, as
potentially disruptive if executed against a live cluster.

Signed-off-by: viktor-kurchenko <[email protected]>

connectivity/builder/builder.go

@@ -149,6 +149,8 @@ var (
 		podToK8sOnControlplane{},
 		podToControlplaneHostCidr{},
 		podToK8sOnControlplaneCidr{},
+		hostFirewallIngress{},
+		hostFirewallEgress{},
 	}
 )
 

connectivity/builder/host_firewall_egress.go

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Cilium
+
+package builder
+
+import (
+	_ "embed"
+
+	"github.com/cilium/cilium-cli/connectivity/check"
+	"github.com/cilium/cilium-cli/connectivity/tests"
+	"github.com/cilium/cilium-cli/utils/features"
+)
+
+//go:embed manifests/host-firewall-egress.yaml
+var hostFirewallEgressPolicyYAML string
+
+type hostFirewallEgress struct{}
+
+func (t hostFirewallEgress) build(ct *check.ConnectivityTest, _ map[string]string) {
+	newTest("host-firewall-egress", ct).
+		WithCondition(func() bool { return ct.Params().IncludeUnsafeTests }).
+		WithFeatureRequirements(features.RequireEnabled(features.HostFirewall)).
+		WithCiliumClusterwidePolicy(hostFirewallEgressPolicyYAML).
+		WithScenarios(tests.HostToPod()).
+		WithExpectations(func(a *check.Action) (egress check.Result, ingress check.Result) {
+			if a.Destination().HasLabel("name", "echo-other-node") {
+				return check.ResultPolicyDenyEgressDrop, check.ResultOK
+			}
+			return check.ResultOK, check.ResultOK
+		})
+}

connectivity/builder/host_firewall_ingress.go

@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Cilium
+
+package builder
+
+import (
+	_ "embed"
+
+	"github.com/cilium/cilium-cli/connectivity/check"
+	"github.com/cilium/cilium-cli/connectivity/tests"
+	"github.com/cilium/cilium-cli/utils/features"
+)
+
+//go:embed manifests/host-firewall-ingress.yaml
+var hostFirewallIngressPolicyYAML string
+
+type hostFirewallIngress struct{}
+
+func (t hostFirewallIngress) build(ct *check.ConnectivityTest, _ map[string]string) {
+	newTest("host-firewall-ingress", ct).
+		WithCondition(func() bool { return ct.Params().IncludeUnsafeTests }).
+		WithFeatureRequirements(features.RequireEnabled(features.HostFirewall)).
+		WithCiliumClusterwidePolicy(hostFirewallIngressPolicyYAML).
+		WithScenarios(tests.PodToHost()).
+		WithExpectations(func(a *check.Action) (egress check.Result, ingress check.Result) {
+			if a.Source().HasLabel("name", "client") {
+				return check.ResultOK, check.ResultPolicyDenyIngressDrop
+			}
+			return check.ResultOK, check.ResultOK
+		})
+}