Unexpected behavior after configuring HAProxy Template Router Settings

[grandflash]

There's possible to open any quantity of multiple parallel socket connections from one IP on route's host and port 80 over configured 'rate-limit-connections.concurrent-tcp' and 'rate-limit-connections.rate-tcp' parameters.

Openshift version 3.6

Steps To Reproduce

1. Create route and configure it with the following annotations:
   haproxy.router.openshift.io/rate-limit-connections: 'true'
   haproxy.router.openshift.io/rate-limit-connections.concurrent-tcp: '1'
   haproxy.router.openshift.io/rate-limit-connections.rate-tcp: '1'
   haproxy.router.openshift.io/rate-limit-connections.rate-http: '10'
2. Try to open multiple concurrent tcp socket connections (2 or more).
3. Ensure that configured rate-tcp and concurrent-tcp limits are are not exceeded:
   sudo lsof -i -P | grep -i "established"

Current Result

java 38615 user 29u IPv6 0x327a86683dfe73db 0t0 TCP 192.168.206.50:55799->myhost:80 (ESTABLISHED)
java 38615 user 30u IPv6 0x327a86683dfe851b 0t0 TCP 192.168.206.50:55796->myhost:80 (ESTABLISHED)
java 38615 user 31u IPv6 0x327a86683dfe685b 0t0 TCP 192.168.206.50:55798->myhost:80 (ESTABLISHED)
java 38615 user 32u IPv6 0x327a86683dfe909b 0t0 TCP 192.168.206.50:55797->myhost:80 (ESTABLISHED)

Expected Result

Concurrent connections to route are equal to '1' (concurrent-tcp=1)
Opened connections to route are equal to '1' (rate-tcp=1)

Additional Information

See full route config and utility for opening multiple concurrent connections.

CrunchifyIsSocketAliveUtility.java.zip
myroute.txt

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[grandflash]

/lifecycle frozen

[grandflash]

/remove-lifecycle stale

[grandflash]

/remove-lifecycle stale

[danwinship]

/remove-sig networking
/sig network-edge