From e43ae8dcb54a078ac5d7fa0a0fb28db0a989d560 Mon Sep 17 00:00:00 2001
From: "Andrey V. Elsukov" <ae@FreeBSD.org>
Date: Fri, 29 May 2020 10:37:42 +0000
Subject: [PATCH] Fix O_IP_FLOW_LOOKUP opcode handling.

Do not check table value matching when table lookup has failed.

Reported by:	Sergey Lobanov
MFC after:	1 week
---
 sys/netpfil/ipfw/ip_fw2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/netpfil/ipfw/ip_fw2.c b/sys/netpfil/ipfw/ip_fw2.c
index 919438cf954b..80077d26d4aa 100644
--- a/sys/netpfil/ipfw/ip_fw2.c
+++ b/sys/netpfil/ipfw/ip_fw2.c
@@ -2106,6 +2106,8 @@ do {								\
 					uint32_t v = 0;
 					match = ipfw_lookup_table(chain,
 					    cmd->arg1, 0, &args->f_id, &v);
+					if (!match)
+						break;
 					if (cmdlen == F_INSN_SIZE(ipfw_insn_u32))
 						match = ((ipfw_insn_u32 *)cmd)->d[0] ==
 						    TARG_VAL(chain, v, tag);