I am trying to implement these two iptables rules:

iptables -I INPUT -p icmp --icmp-type timestamp-request -j DROP
iptables -I OUTPUT -p icmp --icmp-type timestamp-reply -j DROP

I did check https://github.com/puppetlabs/puppetlabs-firewall/blob/main/lib/puppet/type/firewall.rb#L46 and it seems this is supported. We, as probably others, use firewall_multi and define our rules in hiera. In Hiera it looks like this:

'973 DROP ICMP TIMESTAMP REQUEST':
    jump: 'drop'
    chain: 'INPUT'
    proto: 'icmp'
    icmp_match: 'timestamp-request'
  '974 DROP ICMP TIMESTAMP REPLY':
    jump: 'drop'
    chain: 'OUTPUT'
    proto: 'icmp'
    icmp_match: 'timestamp-reply'

When I apply this on a node I get

Firewall_multi[973 DROP ICMP TIMESTAMP REQUEST]: has no parameter named 'icmp_match'

. What am I doing wrong here? Funny enough, we do have rules that use other features listed there which work flawlessly:

'970 LOGDROP icmp':
    jump: 'LOG'
    log_prefix: 'LOGDROP-ICMP '
    chain: 'INPUT'
    proto: 'icmp'
    limit: '5/min'
  '971 LOGDROP tcp':
    jump: 'LOG'
    log_prefix: 'LOGDROP-TCP '
    log_tcp_sequence: true
    chain: 'INPUT'
    proto: 'tcp'
    tcp_flags: 'FIN,SYN,RST,ACK SYN'
    limit: '5/min'
  '972 LOGDROP udp':
    jump: 'LOG'
    log_prefix: 'LOGDROP-UDP '
    chain: 'INPUT'
    proto: 'udp'
    limit: '5/min'
  '999 drop all':
    jump: 'drop'
    proto: 'all'