StatelessFirewall: fix a match condition bug