Add networking validation functions for inbound port restriction and east-west connectivity

[devin-ai-integration]

Add networking validation functions for inbound port restriction and east-west connectivity

Summary

This PR implements two new networking validation functions in pkg/v1/networking:

1. ValidateInboundPortRestriction - Validates that only SSH port (22) is accessible from external sources by testing common ports (21, 23, 25, 53, 80, 443, 993, 995, 3389, 5432, 3306) using netcat (nc) to ensure they're properly blocked.

2. ValidateEastWestConnectivity - Creates two temporary test instances and validates inter-instance communication by testing ping connectivity and SSH port accessibility between instances using private IPs.

Both functions are integrated into the existing validation suite in internal/validation/suite.go and follow established patterns for instance lifecycle validation. The implementation includes proper error handling, cleanup mechanisms, and logging.

Key Fix: Resolved SSH authentication failures in CI by properly handling empty attrs.Name fields - providing a default "test-connectivity" name prevents malformed instance names like "-east" and "-west".

Review & Testing Checklist for Human

• Manual validation testing: Run the full validation suite manually to verify both functions work correctly and don't break existing tests
• Resource cleanup verification: Test failure scenarios (kill process mid-execution, network timeouts) to ensure test instances are properly cleaned up and don't incur unexpected costs
• Port scanning accuracy: Verify the inbound port restriction validation actually catches real security violations by temporarily opening a non-SSH port and confirming the test fails
• Cross-provider compatibility: Test the networking functions work correctly across different cloud providers since network configurations and nc behavior may vary

Recommended Test Plan:

1. Run make test to verify no regressions in existing validation
2. Manually execute the LambdaLabs validation tests to confirm both networking functions pass
3. Monitor cloud provider dashboards during testing to verify proper instance cleanup
4. Test with intentionally misconfigured instances to verify failure detection

---

Diagram

%%{ init : { "theme" : "default" }}%%
graph TD
    ValidationSuite["internal/validation/suite.go<br/>RunInstanceLifecycleValidation"]:::minor-edit
    NetworkingPkg["pkg/v1/networking.go<br/>New validation functions"]:::major-edit
    InstancePkg["pkg/v1/instance.go<br/>Existing instance functions"]:::context
    SSHPkg["pkg/ssh/ssh.go<br/>SSH connection utilities"]:::context
    
    ValidationSuite -->|"calls"| NetworkingPkg
    NetworkingPkg -->|"uses"| InstancePkg
    NetworkingPkg -->|"uses"| SSHPkg
    
    NetworkingPkg -->|"creates"| TestInstance1["Test Instance 1<br/>(temporary)"]:::context
    NetworkingPkg -->|"creates"| TestInstance2["Test Instance 2<br/>(temporary)"]:::context
    
    subgraph Legend
        L1["Major Edit"]:::major-edit
        L2["Minor Edit"]:::minor-edit  
        L3["Context/No Edit"]:::context
    end


classDef major-edit fill:#90EE90
classDef minor-edit fill:#87CEEB
classDef context fill:#FFFFFF

Loading

Notes

• The east-west connectivity function creates real cloud instances during testing, which incurs actual costs and requires careful cleanup
• The SSH authentication bug fix was critical - empty names were causing malformed instance names that broke SSH key association
• Port scanning uses nc (netcat) which should be available on most cloud instance images but behavior may vary
• Both functions follow the existing validation pattern of waiting for instances to be ready before testing
• Proper error handling and cleanup is implemented but should be verified under failure conditions

Session Details:

• Requested by: Alec Fong (@theFong)
• Devin Session: https://app.devin.ai/sessions/519f9b3b34a24f68a1f60122b951c96f

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[theFong]

Lets wire these up in the internal/validation package