diff --git a/ChangeLog b/ChangeLog
index b00813c4ea..b7cc9f9153 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,13 @@ Changes in version 0.1.2.17 - 2007-08-xx
       deprecated since Tor 0.1.1.1-alpha, and keeping it safe and secure
       has been more of a headache than it's worth.
 
+  o Major bugfixes (stream expiration):
+    - Expire not-yet-successful application streams in all cases if
+      they've been around longer than SocksTimeout. Right now there are
+      some cases where the stream will live forever, demanding a new
+      circuit every 15 seconds. Bugfix on 0.1.2.7-alpha; fixes bug 454;
+      reported by lodger.
+
   o Minor features (controller):
     - Add a PROTOCOLINFO controller command. Like AUTHENTICATE, it
       is valid before any authentication has been received. It tells
diff --git a/src/or/circuituse.c b/src/or/circuituse.c
index b145474079..b4f1d00496 100644
--- a/src/or/circuituse.c
+++ b/src/or/circuituse.c
@@ -1215,6 +1215,16 @@ connection_ap_handshake_attach_circuit(edge_connection_t *conn)
 
   conn_age = time(NULL) - conn->_base.timestamp_created;
 
+  if (conn_age >= get_options()->SocksTimeout) {
+    int severity = (!conn->_base.addr && !conn->_base.port) ?
+                     LOG_INFO : LOG_NOTICE;
+    log_fn(severity, LD_APP,
+           "Tried for %d seconds to get a connection to %s:%d. Giving up.",
+           conn_age, safe_str(conn->socks_request->address),
+           conn->socks_request->port);
+    return -1;
+  }
+
   if (!connection_edge_is_rendezvous_stream(conn)) { /* we're a general conn */
     origin_circuit_t *circ=NULL;