fwtester: improve rule_match