[swarm] Firewall vulnerability detected. Several unused ports can be accessed on slave.

[Andrey Lavrentyev]

Detailed bug description:
Exception: Firewall vulnerability detected. Unused port 2621/tcp can be accessed on slave-02_compute (node-1) node. Check /var/tmp/iptables_check_file.old and /var/tmp/iptables_check_file.dump files on the node for details

Traceback: http://paste.openstack.org/show/558190/

Swarm failure: https://product-ci.infra.mirantis.net/job/9.x.system_test.ubuntu.thread_1/13/testReport/%28root%29/ha_one_controller_neutron_warm_restart/

Similar issues:
- https://bugs.launchpad.net/fuel/+bug/1524864
- https://bugs.launchpad.net/fuel/+bug/1378745

Steps to reproduce:
Execute '' test with the following steps:
1. Create cluster
2. Add 1 node with controller role
3. Add 1 node with compute role
4. Deploy the cluster
5. Run network verification
6. Run OSTF
7. Warm restart
8. Wait for HA services to be ready
9. Wait for OS services to be ready
10. Wait for Galera is up
11. Verify firewall rules << FAILED HERE
12. Run network verification
13. Run OSTF

Expected results:
Firewall rules verification is a success

Actual result:
Firewall rules verification failure

Impact:
Swarm failure

Description of the environment:
9.1 snapshot #140

MOS_CENTOS_OS_MIRROR_ID: os-2016-06-23-135731
MOS_CENTOS_PROPOSED_MIRROR_ID: proposed-2016-08-15-172323
MOS_CENTOS_UPDATES_MIRROR_ID: updates-2016-06-23-135916
MOS_CENTOS_HOLDBACK_MIRROR_ID: holdback-2016-06-23-140047
MOS_UBUNTU_MIRROR_ID: 9.0-2016-08-15-132321
UBUNTU_MIRROR_ID: ubuntu-2016-08-03-174238
CENTOS_MIRROR_ID: centos-7.2.1511-2016-05-31-083834

Log will be attached as soon as it's available

[Oleksiy Molchanov (omolchanov)]

It is normal behaviour, because you are sending traffic within single VM and it goes through lo.

And we have rule that is accepting all traffic through lo.

[Alexey Shtokolov (ashtokolov)]

Please check again Oleksiy's comment

[Nastya Urlapova (aurlapova)]

It is green as 4 weeks in row, moved to invalid https://product-ci.infra.mirantis.net/view/9.x_swarm/job/9.x.system_test.ubuntu.thread_1/152/testReport/(root)/ha_one_controller_neutron_warm_restart/ha_one_controller_neutron_warm_restart/history/