1 files changed, 17 insertions, 0 deletions

diff --git a/src/net.cpp b/src/net.cpp
index 3660735..6e74cbb 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -1622,12 +1622,29 @@ void ThreadSocketHandler2(void* parg)
                 unsigned int nNodes = 0;
                 CRITICAL_BLOCK(cs_vNodes)
                     nNodes = (unsigned int)vNodes.size();
+                // Also count how many connections this one address already
+                // holds. A single IP that keeps opening sockets -- a broken
+                // node or a deliberate connection-exhaustion flood -- must not
+                // be able to take the whole table, which is what starved the
+                // relays.
+                unsigned int nFromThisIP = 0;
+                CRITICAL_BLOCK(cs_vNodes)
+                    for (vector<CNode*>::iterator it = vNodes.begin(); it != vNodes.end(); ++it)
+                        if ((*it)->addr.ip == addr.ip)
+                            nFromThisIP++;
+
                 if (nNodes >= MAX_CONNECTIONS)
                 {
                     LogPrint("net", "refusing connection from %s, already at %u\n",
                              addr.ToString().c_str(), nNodes);
                     BtfCloseSocket(hSocket);
                 }
+                else if (nFromThisIP >= MAX_CONNECTIONS_PER_IP)
+                {
+                    LogPrint("net", "refusing connection from %s, already %u from that address\n",
+                             addr.ToString().c_str(), nFromThisIP);
+                    BtfCloseSocket(hSocket);
+                }
                 else
                 {
                     LogPrint("net", "accepted connection from %s\n", addr.ToString().c_str());