From d2b3a2a474e71937a6b1e54eb5453c4ff1a2b3d0 Mon Sep 17 00:00:00 2001
From: Simon Arlott <sa.me.uk>
Date: Sun, 23 Jul 2017 15:34:29 +0100
Subject: [PATCH] ircd: check_server: don't allow a connection if that would
 exceed the class limit

---
 ircd/s_serv.c           | 5 +++++
 modules/core/m_server.c | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/ircd/s_serv.c b/ircd/s_serv.c
index a0d1b16c..0348e4f7 100644
--- a/ircd/s_serv.c
+++ b/ircd/s_serv.c
@@ -437,6 +437,11 @@ check_server(const char *name, struct Client *client_p)
 		return -5;
 	}
 
+	if (client_p->localClient->att_sconf && client_p->localClient->att_sconf->class == server_p->class) {
+		/* this is an outgoing connection that is already attached to the correct class */
+	} else if (CurrUsers(server_p->class) >= MaxUsers(server_p->class)) {
+		return -7;
+	}
 	attach_server_conf(client_p, server_p);
 
 	/* clear ZIP/TB if they support but we dont want them */
diff --git a/modules/core/m_server.c b/modules/core/m_server.c
index ad8f66a9..1a05ac0b 100644
--- a/modules/core/m_server.c
+++ b/modules/core/m_server.c
@@ -208,6 +208,15 @@ mr_server(struct MsgBuf *msgbuf_p, struct Client *client_p, struct Client *sourc
 			exit_client(client_p, client_p, client_p, "Invalid certificate.");
 		}
 
+		return;
+	case -7:
+		sendto_realops_snomask(SNO_GENERAL, L_ALL,
+		     "Connection from servername %s rejected, no more connections allowed in class",
+		     name);
+		ilog(L_SERVER, "Access denied, no more connections allowed in class for %s",
+		     log_client_name(client_p, SHOW_IP));
+
+		exit_client(client_p, client_p, client_p, "Access denied, no more connections allowed in class");
 		return;
 	default:
 		sendto_realops_snomask(SNO_GENERAL, L_ALL,