feat: icmp-pmtud-blocked smell — blocking ICMP wholesale black-holes PMTUD (v1.25.0)

[DannyRuizB]

What

New linter smell icmp-pmtud-blocked (warning) — the IPv4 sibling of icmpv6-blocked, scoped to the one message IPv4 genuinely cannot live without: ICMP type 3 (destination-unreachable, whose code 4 is fragmentation-needed). TCP sets DF on every segment and relies on routers answering "too big"; a firewall that swallows that message turns any smaller-MTU path (VPN, PPPoE, tunnels) into a black hole — the handshake passes, full-size payloads vanish, connections hang.

Two triggers, one id

• Rule-level: the classic -p icmp -j DROP "block ping for security" rule with no covering accept above it. Order matters: the same drop below the conntrack RELATED accept is fine and stays quiet.
• Chain-level: a deny-posture INPUT/FORWARD that accepts real traffic but never accepts ICMP (broadly or type 3) and has no RELATED-state accept.

Deliberately quiet

• A RELATED accept silences it — conntrack classifies ICMP errors about a tracked connection as RELATED. ESTABLISHED alone is not enough (pinned by test).
• A drop scoped to --icmp-type echo-request — blocking ping alone doesn't hurt PMTUD.
• An empty deny-posture FORWARD: a non-forwarding host's FORWARD DROP with no accepts passes no traffic whose PMTUD could break — correct config, not a black hole (this guard keeps every flagship sample clean).
• ufw (before.rules accepts dest-unreach invisibly) and ip6tables (the twin's job); nftables only for ip/inet families.

Wiring

• New sample iptables (ICMP blocked — no PMTUD) trips both variants and is otherwise clean (verified locally).
• 7 dedicated tests + EXPECTED/ALL_SMELLS registration; suite at 150 pass, npm run lint clean.
• README enumeration + changelog, version bump to v1.25.0 (33 → 34 smells).

🤖 Generated with Claude Code