Merge "icmp: randomize the global rate limiter"

icmp_msgs_per_sec - INTEGER

	Limit maximal number of ICMP packets sent per second from this host.

	Only messages whose type matches icmp_ratemask (see below) are

	controlled by this limit.

	controlled by this limit. For security reasons, the precise count

	of messages per second is randomized.

	Default: 1000

icmp_msgs_burst - INTEGER

	icmp_msgs_per_sec controls number of ICMP packets sent per second,

	while icmp_msgs_burst controls the burst size of these packets.

	For security reasons, the precise burst size is randomized.

	Default: 50

icmp_ratemask - INTEGER

/**

 * icmp_global_allow - Are we allowed to send one more ICMP message ?

 *

 * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.

 * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.

 * Returns false if we reached the limit and can not send another packet.

 * Note: called with BH disabled

 */

	}

	credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);

	if (credit) {

		credit--;

		/* We want to use a credit of one in average, but need to randomize

		 * it for security reasons.

		 */

		credit = max_t(int, credit - prandom_u32_max(3), 0);

		rc = true;

	}

	WRITE_ONCE(icmp_global.credit, credit);