session: add rule tags

Change-Id: Id5ebb410f509ac4c83d60e48efd54e00035e5ce6
Signed-off-by: Florin Coras <fcoras@cisco.com>

12 files changed, 468 insertions, 235 deletions

diff --git a/src/vnet/session/application.c b/src/vnet/session/application.c
index c16b4dab057..9a519c763fe 100644
--- a/src/vnet/session/application.c
+++ b/src/vnet/session/application.c
@@ -558,6 +558,7 @@ application_start_stop_proxy_fib_proto (application_t * app, u8 fib_proto,
 
   if (!ip_is_zero (&tc->lcl_ip, 1))
     {
+      memset (&args, 0, sizeof (args));
       memset (&lcl_pref, 0, sizeof (lcl_pref));
       ip_copy (&lcl_pref.fp_addr, &tc->lcl_ip, is_ip4);
       lcl_pref.fp_len = is_ip4 ? 32 : 128;
@@ -572,7 +573,7 @@ application_start_stop_proxy_fib_proto (application_t * app, u8 fib_proto,
       args.table_args.rmt_port = 0;
       args.table_args.action_index = app->index;
       args.table_args.is_add = is_start;
-      args.table_args.transport_proto = transport_proto;
+      args.transport_proto = transport_proto;
       args.appns_index = app->ns_index;
       args.scope = SESSION_RULE_SCOPE_GLOBAL;
       return vnet_session_rule_add_del (&args);
@@ -595,7 +596,7 @@ application_start_stop_proxy (application_t * app, u8 transport_proto,
       args.table_args.rmt_port = 0;
       args.table_args.action_index = app->index;
       args.table_args.is_add = is_start;
-      args.table_args.transport_proto = transport_proto;
+      args.transport_proto = transport_proto;
       args.appns_index = app->ns_index;
       args.scope = SESSION_RULE_SCOPE_LOCAL;
       vnet_session_rule_add_del (&args);
diff --git a/src/vnet/session/mma_template.c b/src/vnet/session/mma_template.c
index 6efb2ff61ab..248ced61451 100644
--- a/src/vnet/session/mma_template.c
+++ b/src/vnet/session/mma_template.c
@@ -94,16 +94,16 @@ RT (mma_rules_table_lookup) (RTT (mma_rules_table) * srt,
   u32 rv;
   int i;
 
-  ASSERT (rule_index != SESSION_RULES_TABLE_INVALID_INDEX);
+  ASSERT (rule_index != MMA_TABLE_INVALID_INDEX);
   rp = RT (mma_rules_table_get_rule) (srt, rule_index);
   ASSERT (rp);
 
   if (!RT (rule_is_match_for_key) (key, rp))
-    return SESSION_RULES_TABLE_INVALID_INDEX;
+    return MMA_TABLE_INVALID_INDEX;
   for (i = 0; i < vec_len (rp->next_indices); i++)
     {
       rv = RT (mma_rules_table_lookup) (srt, key, rp->next_indices[i]);
-      if (rv != SESSION_RULES_TABLE_INVALID_INDEX)
+      if (rv != MMA_TABLE_INVALID_INDEX)
 	return (rv);
     }
   return (rp->action_index);
@@ -118,16 +118,16 @@ RT (mma_rules_table_lookup_rule) (RTT (mma_rules_table) * srt,
   u32 rv;
   int i;
 
-  ASSERT (rule_index != SESSION_RULES_TABLE_INVALID_INDEX);
+  ASSERT (rule_index != MMA_TABLE_INVALID_INDEX);
   rp = RT (mma_rules_table_get_rule) (srt, rule_index);
   ASSERT (rp);
 
   if (!RT (rule_is_match_for_key) (key, rp))
-    return SESSION_RULES_TABLE_INVALID_INDEX;
+    return MMA_TABLE_INVALID_INDEX;
   for (i = 0; i < vec_len (rp->next_indices); i++)
     {
       rv = RT (mma_rules_table_lookup_rule) (srt, key, rp->next_indices[i]);
-      if (rv != SESSION_RULES_TABLE_INVALID_INDEX)
+      if (rv != MMA_TABLE_INVALID_INDEX)
 	return (rv);
     }
   return rule_index;
@@ -214,15 +214,15 @@ RT (mma_rules_table_del_rule) (RTT (mma_rules_table) * srt,
   u32 rv;
   int i;
 
-  ASSERT (rule_index != SESSION_RULES_TABLE_INVALID_INDEX);
+  ASSERT (rule_index != MMA_TABLE_INVALID_INDEX);
   rp = RT (mma_rules_table_get_rule) (srt, rule_index);
 
   if (!RT (rule_is_match_for_key) (&rule->match, rp))
-    return SESSION_RULES_TABLE_INVALID_INDEX;
+    return MMA_TABLE_INVALID_INDEX;
   if (RT (rule_is_exact_match) (rule, rp))
     {
       if (rule_index == srt->root_index)
-	rp->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
+	rp->action_index = MMA_TABLE_INVALID_INDEX;
       return 1;
     }
   for (i = 0; i < vec_len (rp->next_indices); i++)
@@ -257,7 +257,7 @@ RT (mma_rules_table_del_rule) (RTT (mma_rules_table) * srt,
       else if (rv == 0)
 	return rv;
     }
-  return SESSION_RULES_TABLE_INVALID_INDEX;
+  return MMA_TABLE_INVALID_INDEX;
 }
 
 /*
diff --git a/src/vnet/session/mma_template.h b/src/vnet/session/mma_template.h
index 8b6fd75e69c..fd5e3ea5717 100644
--- a/src/vnet/session/mma_template.h
+++ b/src/vnet/session/mma_template.h
@@ -30,7 +30,7 @@
 #define __rtt(a, b) _rtt(a,b)
 #define RTT(a) __rtt(a, MMA_RT_TYPE)
 
-#define SESSION_RULES_TABLE_INVALID_INDEX ((u32)~0)
+#define MMA_TABLE_INVALID_INDEX ((u32)~0)
 
 typedef struct
 {
@@ -79,7 +79,8 @@ RT (session_rule_free) (RTT (mma_rules_table) * srt, RTT (mma_rule) * rule);
 RTT (mma_rule) *
 RT (mma_table_get_rule) (RTT (mma_rules_table) * srt, u32 srt_index);
 u32
-RT (mma_table_rule_index) (RTT (mma_rules_table) * srt, RTT (mma_rule) * sr);
+RT (mma_rules_table_rule_index) (RTT (mma_rules_table) * srt,
+				 RTT (mma_rule) * sr);
 #endif /* SRC_VNET_SESSION_MMA_TEMPLATE_H_ */
 
 /*
diff --git a/src/vnet/session/session.api b/src/vnet/session/session.api
index 8de09226365..6ed75efb08c 100644
--- a/src/vnet/session/session.api
+++ b/src/vnet/session/session.api
@@ -395,6 +395,7 @@ autoreply define session_rule_add_del {
   u8 is_add;
   u32 appns_index;
   u8 scope;
+  u8 tag[64];
 };
 
 /** \brief Dump session rules
@@ -439,6 +440,7 @@ define session_rules_details
   u32 action_index;
   u32 appns_index;
   u8 scope;
+  u8 tag[64];
 };
 
 /*
diff --git a/src/vnet/session/session_api.c b/src/vnet/session/session_api.c
index 7ca87a512a3..fc0a257f9fe 100755
--- a/src/vnet/session/session_api.c
+++ b/src/vnet/session/session_api.c
@@ -792,6 +792,7 @@ vl_api_session_rule_add_del_t_handler (vl_api_session_rule_add_del_t * mp)
   u8 fib_proto;
   int rv = 0;
 
+  memset (&args, 0, sizeof (args));
   fib_proto = mp->is_ip4 ? FIB_PROTOCOL_IP4 : FIB_PROTOCOL_IP6;
 
   table_args->lcl.fp_len = mp->lcl_plen;
@@ -802,6 +803,8 @@ vl_api_session_rule_add_del_t_handler (vl_api_session_rule_add_del_t * mp)
   table_args->rmt_port = clib_net_to_host_u16 (mp->rmt_port);
   table_args->action_index = clib_net_to_host_u32 (mp->action_index);
   table_args->is_add = mp->is_add;
+  mp->tag[sizeof (mp->tag) - 1] = 0;
+  table_args->tag = format (0, "%s", mp->tag);
   args.appns_index = clib_net_to_host_u32 (mp->appns_index);
   args.scope = mp->scope;
 
@@ -815,12 +818,13 @@ vl_api_session_rule_add_del_t_handler (vl_api_session_rule_add_del_t * mp)
       rv = clib_error_get_code (error);
       clib_error_report (error);
     }
+  vec_free (table_args->tag);
   REPLY_MACRO (VL_API_SESSION_RULE_ADD_DEL_REPLY);
 }
 
 static void
 send_session_rule_details4 (mma_rule_16_t * rule, u8 is_local,
-			    u8 transport_proto, u32 appns_index,
+			    u8 transport_proto, u32 appns_index, u8 * tag,
 			    unix_shared_memory_queue_t * q, u32 context)
 {
   vl_api_session_rules_details_t *rmp = 0;
@@ -846,13 +850,18 @@ send_session_rule_details4 (mma_rule_16_t * rule, u8 is_local,
     is_local ? SESSION_RULE_SCOPE_LOCAL : SESSION_RULE_SCOPE_GLOBAL;
   rmp->transport_proto = transport_proto;
   rmp->appns_index = clib_host_to_net_u32 (appns_index);
+  if (tag)
+    {
+      clib_memcpy (rmp->tag, tag, vec_len (tag));
+      rmp->tag[vec_len (tag)] = 0;
+    }
 
   vl_msg_api_send_shmem (q, (u8 *) & rmp);
 }
 
 static void
-send_session_rule_details6 (mma_rule_40_t * rule, u8 scope,
-			    u8 transport_proto, u32 appns_index,
+send_session_rule_details6 (mma_rule_40_t * rule, u8 is_local,
+			    u8 transport_proto, u32 appns_index, u8 * tag,
 			    unix_shared_memory_queue_t * q, u32 context)
 {
   vl_api_session_rules_details_t *rmp = 0;
@@ -874,46 +883,55 @@ send_session_rule_details6 (mma_rule_40_t * rule, u8 scope,
   rmp->lcl_port = clib_host_to_net_u16 (match->lcl_port);
   rmp->rmt_port = clib_host_to_net_u16 (match->rmt_port);
   rmp->action_index = clib_host_to_net_u32 (rule->action_index);
-  rmp->scope = scope;
+  rmp->scope =
+    is_local ? SESSION_RULE_SCOPE_LOCAL : SESSION_RULE_SCOPE_GLOBAL;
   rmp->transport_proto = transport_proto;
   rmp->appns_index = clib_host_to_net_u32 (appns_index);
+  if (tag)
+    {
+      clib_memcpy (rmp->tag, tag, vec_len (tag));
+      rmp->tag[vec_len (tag)] = 0;
+    }
 
   vl_msg_api_send_shmem (q, (u8 *) & rmp);
 }
 
 static void
 send_session_rules_table_details (session_rules_table_t * srt, u8 fib_proto,
-				  u8 is_local, u32 appns_index,
+				  u8 tp, u8 is_local, u32 appns_index,
 				  unix_shared_memory_queue_t * q, u32 context)
 {
   mma_rule_16_t *rule16;
   mma_rule_40_t *rule40;
   mma_rules_table_16_t *srt16;
   mma_rules_table_40_t *srt40;
-  u8 tp;
+  u32 ri;
 
-  for (tp = 0; tp < TRANSPORT_N_PROTO; tp++)
+  if (is_local || fib_proto == FIB_PROTOCOL_IP4)
     {
-      if (is_local || fib_proto == FIB_PROTOCOL_IP4)
-	{
-          /* *INDENT-OFF* */
-          srt16 = &srt->session_rules_tables_16[tp];
-          pool_foreach (rule16, srt16->rules, ({
-            send_session_rule_details4 (rule16, is_local, tp,
-                                        appns_index, q, context);
-          }));
-          /* *INDENT-ON* */
-	}
-      if (is_local || fib_proto == FIB_PROTOCOL_IP6)
-	{
-          /* *INDENT-OFF* */
-          srt40 = &srt->session_rules_tables_40[tp];
-          pool_foreach (rule40, srt40->rules, ({
-            send_session_rule_details6 (rule40, is_local, tp,
-                                        appns_index, q, context);
-          }));
-          /* *INDENT-ON* */
-	}
+      u8 *tag = 0;
+      /* *INDENT-OFF* */
+      srt16 = &srt->session_rules_tables_16;
+      pool_foreach (rule16, srt16->rules, ({
+	ri = mma_rules_table_rule_index_16 (srt16, rule16);
+	tag = session_rules_table_rule_tag (srt, ri, 1);
+        send_session_rule_details4 (rule16, is_local, tp, appns_index, tag,
+                                    q, context);
+      }));
+      /* *INDENT-ON* */
+    }
+  if (is_local || fib_proto == FIB_PROTOCOL_IP6)
+    {
+      u8 *tag = 0;
+      /* *INDENT-OFF* */
+      srt40 = &srt->session_rules_tables_40;
+      pool_foreach (rule40, srt40->rules, ({
+	ri = mma_rules_table_rule_index_40 (srt40, rule40);
+	tag = session_rules_table_rule_tag (srt, ri, 1);
+        send_session_rule_details6 (rule40, is_local, tp, appns_index, tag,
+                                    q, context);
+      }));
+      /* *INDENT-ON* */
     }
 }
 
@@ -922,6 +940,7 @@ vl_api_session_rules_dump_t_handler (vl_api_one_map_server_dump_t * mp)
 {
   unix_shared_memory_queue_t *q = NULL;
   session_table_t *st;
+  u8 tp;
 
   q = vl_api_client_index_to_input_queue (mp->client_index);
   if (q == 0)
@@ -929,9 +948,13 @@ vl_api_session_rules_dump_t_handler (vl_api_one_map_server_dump_t * mp)
 
   /* *INDENT-OFF* */
   session_table_foreach (st, ({
-    send_session_rules_table_details (&st->session_rules, st->active_fib_proto,
-                                      st->is_local, st->appns_index, q,
-                                      mp->context);
+    for (tp = 0; tp < TRANSPORT_N_PROTO; tp++)
+      {
+        send_session_rules_table_details (&st->session_rules[tp],
+                                          st->active_fib_proto, tp,
+                                          st->is_local, st->appns_index, q,
+                                          mp->context);
+      }
   }));
   /* *INDENT-ON* */
 }
diff --git a/src/vnet/session/session_lookup.c b/src/vnet/session/session_lookup.c
index d537b9c1c82..6cdb839ceff 100644
--- a/src/vnet/session/session_lookup.c
+++ b/src/vnet/session/session_lookup.c
@@ -368,12 +368,13 @@ session_lookup_app_listen_session (u32 app_index, u8 fib_proto,
 }
 
 stream_session_t *
-session_lookup_rules_table4 (session_rules_table_t * srt, u8 proto,
+session_lookup_rules_table4 (session_table_t * st, u8 proto,
 			     ip4_address_t * lcl, u16 lcl_port,
 			     ip4_address_t * rmt, u16 rmt_port)
 {
+  session_rules_table_t *srt = &st->session_rules[proto];
   u32 action_index, session_index;
-  action_index = session_rules_table_lookup4 (srt, proto, lcl, rmt, lcl_port,
+  action_index = session_rules_table_lookup4 (srt, lcl, rmt, lcl_port,
 					      rmt_port);
   session_index = session_lookup_action_to_session (action_index);
   /* Nothing sophisticated for now, action index is app index */
@@ -382,12 +383,13 @@ session_lookup_rules_table4 (session_rules_table_t * srt, u8 proto,
 }
 
 stream_session_t *
-session_lookup_rules_table6 (session_rules_table_t * srt, u8 proto,
+session_lookup_rules_table6 (session_table_t * st, u8 proto,
 			     ip6_address_t * lcl, u16 lcl_port,
 			     ip6_address_t * rmt, u16 rmt_port)
 {
+  session_rules_table_t *srt = &st->session_rules[proto];
   u32 action_index, session_index;
-  action_index = session_rules_table_lookup6 (srt, proto, lcl, rmt, lcl_port,
+  action_index = session_rules_table_lookup6 (srt, lcl, rmt, lcl_port,
 					      rmt_port);
   session_index = session_lookup_action_to_session (action_index);
   return session_lookup_app_listen_session (session_index, FIB_PROTOCOL_IP6,
@@ -397,6 +399,7 @@ session_lookup_rules_table6 (session_rules_table_t * srt, u8 proto,
 u64
 session_lookup_session_endpoint (u32 table_index, session_endpoint_t * sep)
 {
+  session_rules_table_t *srt;
   session_table_t *st;
   session_kv4_t kv4;
   session_kv6_t kv6;
@@ -417,9 +420,9 @@ session_lookup_session_endpoint (u32 table_index, session_endpoint_t * sep)
 	return kv4.value;
 
       memset (&lcl4, 0, sizeof (lcl4));
-      ai = session_rules_table_lookup4 (&st->session_rules,
-					sep->transport_proto, &lcl4,
-					&sep->ip.ip4, 0, sep->port);
+      srt = &st->session_rules[sep->transport_proto];
+      ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
+					sep->port);
       if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
 	return session_lookup_action_to_session (ai);
     }
@@ -432,9 +435,9 @@ session_lookup_session_endpoint (u32 table_index, session_endpoint_t * sep)
 	return kv6.value;
 
       memset (&lcl6, 0, sizeof (lcl6));
-      ai = session_rules_table_lookup6 (&st->session_rules,
-					sep->transport_proto, &lcl6,
-					&sep->ip.ip6, 0, sep->port);
+      srt = &st->session_rules[sep->transport_proto];
+      ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
+					sep->port);
       if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
 	return session_lookup_action_to_session (ai);
     }
@@ -466,8 +469,7 @@ session_lookup_global_session_endpoint (session_endpoint_t * sep)
       if (rv == 0)
 	return session_get_from_handle (kv4.value);
       memset (&lcl4, 0, sizeof (lcl4));
-      return session_lookup_rules_table4 (&st->session_rules,
-					  sep->transport_proto, &lcl4, 0,
+      return session_lookup_rules_table4 (st, sep->transport_proto, &lcl4, 0,
 					  &sep->ip.ip4, sep->port);
     }
   else
@@ -478,8 +480,7 @@ session_lookup_global_session_endpoint (session_endpoint_t * sep)
       if (rv == 0)
 	return session_get_from_handle (kv6.value);
       memset (&lcl6, 0, sizeof (lcl6));
-      return session_lookup_rules_table6 (&st->session_rules,
-					  sep->transport_proto, &lcl6, 0,
+      return session_lookup_rules_table6 (st, sep->transport_proto, &lcl6, 0,
 					  &sep->ip.ip6, sep->port);
     }
 }
@@ -488,6 +489,7 @@ u32
 session_lookup_local_session_endpoint (u32 table_index,
 				       session_endpoint_t * sep)
 {
+  session_rules_table_t *srt;
   session_table_t *st;
   session_kv4_t kv4;
   session_kv6_t kv6;
@@ -517,9 +519,9 @@ session_lookup_local_session_endpoint (u32 table_index,
 	return (u32) kv4.value;
 
       memset (&lcl4, 0, sizeof (lcl4));
-      ai = session_rules_table_lookup4 (&st->session_rules,
-					sep->transport_proto, &lcl4,
-					&sep->ip.ip4, 0, sep->port);
+      srt = &st->session_rules[sep->transport_proto];
+      ai = session_rules_table_lookup4 (srt, &lcl4, &sep->ip.ip4, 0,
+					sep->port);
       if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
 	return session_lookup_action_to_session (ai);
     }
@@ -540,9 +542,9 @@ session_lookup_local_session_endpoint (u32 table_index,
 	return (u32) kv6.value;
 
       memset (&lcl6, 0, sizeof (lcl6));
-      ai = session_rules_table_lookup6 (&st->session_rules,
-					sep->transport_proto, &lcl6,
-					&sep->ip.ip6, 0, sep->port);
+      srt = &st->session_rules[sep->transport_proto];
+      ai = session_rules_table_lookup6 (srt, &lcl6, &sep->ip.ip6, 0,
+					sep->port);
       if (ai != SESSION_RULES_TABLE_INVALID_INDEX)
 	return session_lookup_action_to_session (ai);
     }
@@ -723,20 +725,20 @@ session_lookup_half_open_connection (u64 handle, u8 proto, u8 is_ip4)
   return 0;
 }
 
-transport_connection_t *
-session_lookup_rules_table_connection4 (session_rules_table_t * srt, u8 proto,
+static transport_connection_t *
+session_lookup_rules_table_connection4 (session_table_t * st, u8 proto,
 					ip4_address_t * lcl, u16 lcl_port,
 					ip4_address_t * rmt, u16 rmt_port)
 {
   stream_session_t *s;
-  s = session_lookup_rules_table4 (srt, proto, lcl, lcl_port, rmt, rmt_port);
+  s = session_lookup_rules_table4 (st, proto, lcl, lcl_port, rmt, rmt_port);
   if (s)
     return tp_vfts[s->session_type].get_listener (s->connection_index);
   return 0;
 }
 
-transport_connection_t *
-session_lookup_rules_table_connection6 (session_rules_table_t * srt, u8 proto,
+static transport_connection_t *
+session_lookup_rules_table_connection6 (session_table_t * srt, u8 proto,
 					ip6_address_t * lcl, u16 lcl_port,
 					ip6_address_t * rmt, u16 rmt_port)
 {
@@ -811,9 +813,8 @@ session_lookup_connection_wt4 (u32 fib_index, ip4_address_t * lcl,
     }
 
   /* Check the session rules table */
-  return session_lookup_rules_table_connection4 (&st->session_rules, proto,
-						 lcl, lcl_port, rmt,
-						 rmt_port);
+  return session_lookup_rules_table_connection4 (st, proto, lcl, lcl_port,
+						 rmt, rmt_port);
 }
 
 /**
@@ -869,9 +870,8 @@ session_lookup_connection4 (u32 fib_index, ip4_address_t * lcl,
       return tp_vfts[sst].get_half_open (kv4.value & 0xFFFFFFFF);
     }
   /* Check the session rules table */
-  return session_lookup_rules_table_connection4 (&st->session_rules, proto,
-						 lcl, lcl_port, rmt,
-						 rmt_port);
+  return session_lookup_rules_table_connection4 (st, proto, lcl, lcl_port,
+						 rmt, rmt_port);
 }
 
 /**
@@ -909,7 +909,7 @@ session_lookup_safe4 (u32 fib_index, ip4_address_t * lcl, ip4_address_t * rmt,
   /* If nothing is found, check if any listener is available */
   if ((s = session_lookup_listener4_i (st, lcl, lcl_port, proto)))
     return s;
-  return session_lookup_rules_table4 (&st->session_rules, proto, lcl,
+  return session_lookup_rules_table4 (st, proto, lcl,
 				      lcl_port, rmt, rmt_port);
 }
 
@@ -975,9 +975,8 @@ session_lookup_connection_wt6 (u32 fib_index, ip6_address_t * lcl,
       return tp_vfts[sst].get_half_open (kv6.value & 0xFFFFFFFF);
     }
 
-  return session_lookup_rules_table_connection6 (&st->session_rules, proto,
-						 lcl, lcl_port, rmt,
-						 rmt_port);
+  return session_lookup_rules_table_connection6 (st, proto, lcl, lcl_port,
+						 rmt, rmt_port);
 }
 
 /**
@@ -1032,9 +1031,8 @@ session_lookup_connection6 (u32 fib_index, ip6_address_t * lcl,
       return tp_vfts[sst].get_half_open (kv6.value & 0xFFFFFFFF);
     }
 
-  return session_lookup_rules_table_connection6 (&st->session_rules, proto,
-						 lcl, lcl_port, rmt,
-						 rmt_port);
+  return session_lookup_rules_table_connection6 (st, proto, lcl, lcl_port,
+						 rmt, rmt_port);
 }
 
 /**
@@ -1071,7 +1069,7 @@ session_lookup_safe6 (u32 fib_index, ip6_address_t * lcl, ip6_address_t * rmt,
   /* If nothing is found, check if any listener is available */
   if ((s = session_lookup_listener6_i (st, lcl, lcl_port, proto)))
     return s;
-  return session_lookup_rules_table6 (&st->session_rules, proto, lcl,
+  return session_lookup_rules_table6 (st, proto, lcl,
 				      lcl_port, rmt, rmt_port);
 }
 
@@ -1110,6 +1108,7 @@ clib_error_t *
 vnet_session_rule_add_del (session_rule_add_del_args_t * args)
 {
   app_namespace_t *app_ns = app_namespace_get (args->appns_index);
+  session_rules_table_t *srt;
   session_table_t *st;
   u32 fib_index;
   u8 fib_proto;
@@ -1121,20 +1120,27 @@ vnet_session_rule_add_del (session_rule_add_del_args_t * args)
   if (args->scope > 3)
     return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
 				   "invalid scope");
+  if (args->transport_proto != TRANSPORT_PROTO_TCP
+      && args->transport_proto != TRANSPORT_PROTO_UDP)
+    return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
+				   "invalid transport proto");
   if ((args->scope & SESSION_RULE_SCOPE_GLOBAL) || args->scope == 0)
     {
       fib_proto = args->table_args.rmt.fp_proto;
       fib_index = app_namespace_get_fib_index (app_ns, fib_proto);
       st = session_table_get_for_fib_index (fib_proto, fib_index);
-      if ((error = session_rules_table_add_del (&st->session_rules,
-						&args->table_args)))
-	return error;
+      srt = &st->session_rules[args->transport_proto];
+      if ((error = session_rules_table_add_del (srt, &args->table_args)))
+	{
+	  clib_error_report (error);
+	  return error;
+	}
     }
   if (args->scope & SESSION_RULE_SCOPE_LOCAL)
     {
       st = app_namespace_get_local_table (app_ns);
-      error = session_rules_table_add_del (&st->session_rules,
-					   &args->table_args);
+      srt = &st->session_rules[args->transport_proto];
+      error = session_rules_table_add_del (srt, &args->table_args);
     }
   return error;
 }
@@ -1232,12 +1238,14 @@ static clib_error_t *
 session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
 			 vlib_cli_command_t * cmd)
 {
-  u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen, rmt_plen;
+  u32 proto = ~0, lcl_port, rmt_port, action = 0, lcl_plen = 0, rmt_plen = 0;
   u32 appns_index, scope = 0;
   ip46_address_t lcl_ip, rmt_ip;
   u8 is_ip4 = 1, conn_set = 0;
   u8 fib_proto, is_add = 1, *ns_id = 0;
+  u8 *tag = 0;
   app_namespace_t *app_ns;
+  clib_error_t *error;
 
   memset (&lcl_ip, 0, sizeof (lcl_ip));
   memset (&rmt_ip, 0, sizeof (rmt_ip));
@@ -1275,19 +1283,42 @@ session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
 	}
       else if (unformat (input, "action %d", &action))
 	;
+      else if (unformat (input, "tag %_%v%_", &tag))
+	;
       else
 	return clib_error_return (0, "unknown input `%U'",
 				  format_unformat_error, input);
     }
 
-  if (proto == ~0 || !conn_set || action == ~0)
-    return clib_error_return (0, "proto, connection and action must be set");
+  if (proto == ~0)
+    {
+      vlib_cli_output (vm, "proto must be set");
+      return 0;
+    }
+  if (is_add && !conn_set && action == ~0)
+    {
+      vlib_cli_output (vm, "connection and action must be set for add");
+      return 0;
+    }
+  if (!is_add && !tag && !conn_set)
+    {
+      vlib_cli_output (vm, "connection or tag must be set for delete");
+      return 0;
+    }
+  if (vec_len (tag) > SESSION_RULE_TAG_MAX_LEN)
+    {
+      vlib_cli_output (vm, "tag too long (max u64)");
+      return 0;
+    }
 
   if (ns_id)
     {
       app_ns = app_namespace_get_from_id (ns_id);
       if (!app_ns)
-	return clib_error_return (0, "namespace %v does not exist", ns_id);
+	{
+	  vlib_cli_output (vm, "namespace %v does not exist", ns_id);
+	  return 0;
+	}
     }
   else
     {
@@ -1307,10 +1338,13 @@ session_rule_command_fn (vlib_main_t * vm, unformat_input_t * input,
     .table_args.rmt_port = rmt_port,
     .table_args.action_index = action,
     .table_args.is_add = is_add,
+    .table_args.tag = tag,
     .appns_index = appns_index,
     .scope = scope,
   };
-  return vnet_session_rule_add_del (&args);
+  error = vnet_session_rule_add_del (&args);
+  vec_free (tag);
+  return error;
 }
 
 /* *INDENT-OFF* */
@@ -1328,10 +1362,11 @@ session_lookup_dump_rules_table (u32 fib_index, u8 fib_proto,
 				 u8 transport_proto)
 {
   vlib_main_t *vm = vlib_get_main ();
+  session_rules_table_t *srt;
   session_table_t *st;
   st = session_table_get_for_fib_index (fib_index, fib_proto);
-  session_rules_table_cli_dump (vm, &st->session_rules, fib_proto,
-				transport_proto);
+  srt = &st->session_rules[transport_proto];
+  session_rules_table_cli_dump (vm, srt, fib_proto);
 }
 
 void
@@ -1339,10 +1374,11 @@ session_lookup_dump_local_rules_table (u32 table_index, u8 fib_proto,
 				       u8 transport_proto)
 {
   vlib_main_t *vm = vlib_get_main ();
+  session_rules_table_t *srt;
   session_table_t *st;
   st = session_table_get (table_index);
-  session_rules_table_cli_dump (vm, &st->session_rules, fib_proto,
-				transport_proto);
+  srt = &st->session_rules[transport_proto];
+  session_rules_table_cli_dump (vm, srt, fib_proto);
 }
 
 static clib_error_t *
@@ -1354,6 +1390,7 @@ show_session_rules_command_fn (vlib_main_t * vm, unformat_input_t * input,
   ip46_address_t lcl_ip, rmt_ip;
   u8 is_ip4 = 1, show_one = 0;
   app_namespace_t *app_ns;
+  session_rules_table_t *srt;
   session_table_t *st;
   u8 *ns_id = 0, fib_proto;
 
@@ -1423,16 +1460,17 @@ show_session_rules_command_fn (vlib_main_t * vm, unformat_input_t * input,
 
   if (show_one)
     {
-      session_rules_table_show_rule (vm, &st->session_rules, transport_proto,
-				     &lcl_ip, lcl_port, &rmt_ip, rmt_port,
-				     is_ip4);
+      srt = &st->session_rules[transport_proto];
+      session_rules_table_show_rule (vm, srt, &lcl_ip, lcl_port, &rmt_ip,
+				     rmt_port, is_ip4);
       return 0;
     }
 
-  session_rules_table_cli_dump (vm, &st->session_rules, FIB_PROTOCOL_IP4,
-				transport_proto);
-  session_rules_table_cli_dump (vm, &st->session_rules, FIB_PROTOCOL_IP6,
-				transport_proto);
+  vlib_cli_output (vm, "%U rules table", format_transport_proto,
+		   transport_proto);
+  srt = &st->session_rules[transport_proto];
+  session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4);
+  session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP6);
 
   vec_free (ns_id);
   return 0;
diff --git a/src/vnet/session/session_lookup.h b/src/vnet/session/session_lookup.h
index fa89727e2fe..246ab524b0f 100644
--- a/src/vnet/session/session_lookup.h
+++ b/src/vnet/session/session_lookup.h
@@ -113,6 +113,10 @@ typedef struct _session_rule_add_del_args
    * Rule scope flag.
    */
   u8 scope;
+  /**
+   * Transport protocol for the rule
+   */
+  u8 transport_proto;
 } session_rule_add_del_args_t;
 
 clib_error_t *vnet_session_rule_add_del (session_rule_add_del_args_t * args);
diff --git a/src/vnet/session/session_rules_table.c b/src/vnet/session/session_rules_table.c
index 685871d46ed..fa8a056fbf0 100644
--- a/src/vnet/session/session_rules_table.c
+++ b/src/vnet/session/session_rules_table.c
@@ -20,6 +20,86 @@
 #include <vnet/session/session_rules_table.h>
 #include <vnet/session/transport.h>
 
+u32
+session_rule_tag_key_index (u32 ri, u8 is_ip4)
+{
+  return ((ri << 1) | is_ip4);
+}
+
+void
+session_rule_tag_key_index_parse (u32 rti_key, u32 * ri, u8 * is_ip4)
+{
+  *is_ip4 = rti_key & 1;
+  *ri = rti_key >> 1;
+}
+
+u8 *
+session_rules_table_rule_tag (session_rules_table_t * srt, u32 ri, u8 is_ip4)
+{
+  uword *tip;
+  session_rule_tag_t *rt;
+
+  tip =
+    hash_get (srt->tags_by_rules, session_rule_tag_key_index (ri, is_ip4));
+  if (tip)
+    {
+      rt = pool_elt_at_index (srt->rule_tags, *tip);
+      return rt->tag;
+    }
+  return 0;
+}
+
+void
+session_rules_table_add_del_tag (session_rules_table_t * srt, u8 * tag,
+				 u32 rule_index, u8 is_ip4, u8 is_add)
+{
+  uword *rip, *rtip;
+  session_rule_tag_t *rt;
+  u32 rti_key;
+
+  if (tag == 0)
+    return;
+  if (is_add)
+    {
+      pool_get (srt->rule_tags, rt);
+      rt->tag = vec_dup (tag);
+      hash_set_mem (srt->rules_by_tag, rt->tag, rule_index);
+      rti_key = session_rule_tag_key_index (rule_index, is_ip4);
+      hash_set (srt->tags_by_rules, rti_key, rt - srt->rule_tags);
+    }
+  else
+    {
+      rip = hash_get_mem (srt->rules_by_tag, tag);
+      if (!rip)
+	{
+	  clib_warning ("tag has no rule associated");
+	  return;
+	}
+      rti_key = session_rule_tag_key_index (*rip, is_ip4);
+      rtip = hash_get (srt->tags_by_rules, rti_key);
+      if (!rtip)
+	{
+	  clib_warning ("rule has no tag associated");
+	  return;
+	}
+      rt = pool_elt_at_index (srt->rule_tags, *rtip);
+      ASSERT (rt);
+      hash_unset_mem (srt->rules_by_tag, tag);
+      hash_unset (srt->tags_by_rules, rti_key);
+      pool_put (srt->rule_tags, rt);
+    }
+}
+
+u32
+session_rules_table_rule_for_tag (session_rules_table_t * srt, u8 * tag)
+{
+  uword *rp;
+  if (tag == 0)
+    return SESSION_RULES_TABLE_INVALID_INDEX;
+  rp = hash_get_mem (srt->rules_by_tag, tag);
+  return (rp == 0 ? SESSION_RULES_TABLE_INVALID_INDEX : *rp);
+}
+
 static void
 fib_pref_normalize (fib_prefix_t * pref)
 {
@@ -32,64 +112,76 @@ fib_pref_normalize (fib_prefix_t * pref)
 u8 *
 format_session_rule4 (u8 * s, va_list * args)
 {
-  mma_rules_table_16_t *srt = va_arg (*args, mma_rules_table_16_t *);
+  session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
   mma_rule_16_t *sr = va_arg (*args, mma_rule_16_t *);
   session_mask_or_match_4_t *mask, *match;
+  mma_rules_table_16_t *srt4;
+  u8 *tag = 0, *null_tag = format (0, "none");
+  u32 ri;
   int i;
 
+  srt4 = &srt->session_rules_tables_16;
+  ri = mma_rules_table_rule_index_16 (srt4, sr);
+  tag = session_rules_table_rule_tag (srt, ri, 1);
   match = (session_mask_or_match_4_t *) & sr->match;
   mask = (session_mask_or_match_4_t *) & sr->mask;
 
-  s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d",
-	      mma_rules_table_rule_index_16 (srt, sr), format_ip4_address,
-	      &match->lcl_ip,
-	      ip4_mask_to_preflen (&mask->lcl_ip),
-	      match->lcl_port, format_ip4_address, &match->rmt_ip,
-	      ip4_mask_to_preflen (&mask->rmt_ip),
-	      match->rmt_port, sr->action_index);
+  s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
+	      format_ip4_address, &match->lcl_ip,
+	      ip4_mask_to_preflen (&mask->lcl_ip), match->lcl_port,
+	      format_ip4_address, &match->rmt_ip,
+	      ip4_mask_to_preflen (&mask->rmt_ip), match->rmt_port,
+	      sr->action_index, tag ? tag : null_tag);
   if (vec_len (sr->next_indices))
     {
       s = format (s, "\n    children: ");
       for (i = 0; i < vec_len (sr->next_indices); i++)
 	s = format (s, "%d ", sr->next_indices[i]);
     }
+  vec_free (null_tag);
   return s;
 }
 
 u8 *
 format_session_rule6 (u8 * s, va_list * args)
 {
-  mma_rules_table_40_t *srt = va_arg (*args, mma_rules_table_40_t *);
+  session_rules_table_t *srt = va_arg (*args, session_rules_table_t *);
   mma_rule_40_t *sr = va_arg (*args, mma_rule_40_t *);
   session_mask_or_match_6_t *mask, *match;
+  mma_rules_table_40_t *srt6;
+  u8 *tag = 0, *null_tag = format (0, "none");
+  u32 ri;
   int i;
 
+  srt6 = &srt->session_rules_tables_40;
+  ri = mma_rules_table_rule_index_40 (srt6, sr);
+  tag = session_rules_table_rule_tag (srt, ri, 0);
   match = (session_mask_or_match_6_t *) & sr->match;
   mask = (session_mask_or_match_6_t *) & sr->mask;
 
-  s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d",
-	      mma_rules_table_rule_index_40 (srt, sr), format_ip6_address,
-	      &match->lcl_ip, ip6_mask_to_preflen (&mask->lcl_ip),
-	      match->lcl_port, format_ip6_address, &match->rmt_ip,
+  s = format (s, "[%d] rule: %U/%d %d %U/%d %d action: %d tag: %v", ri,
+	      format_ip6_address, &match->lcl_ip,
+	      ip6_mask_to_preflen (&mask->lcl_ip), match->lcl_port,
+	      format_ip6_address, &match->rmt_ip,
 	      ip6_mask_to_preflen (&mask->rmt_ip), match->rmt_port,
-	      sr->action_index);
+	      sr->action_index, tag ? tag : null_tag);
   if (vec_len (sr->next_indices))
     {
       s = format (s, "\n    children: ");
       for (i = 0; i < vec_len (sr->next_indices); i++)
 	s = format (s, "%d ", sr->next_indices[i]);
     }
+  vec_free (null_tag);
   return s;
 }
 
 void *
-session_rules_table_get (session_rules_table_t * srt, u8 transport_proto,
-			 u8 fib_proto)
+session_rules_table_get (session_rules_table_t * srt, u8 fib_proto)
 {
   if (fib_proto == FIB_PROTOCOL_IP4)
-    return &srt->session_rules_tables_16[transport_proto];
+    return &srt->session_rules_tables_16;
   else if (fib_proto == FIB_PROTOCOL_IP6)
-    return &srt->session_rules_tables_40[transport_proto];
+    return &srt->session_rules_tables_40;
   return 0;
 }
 
@@ -208,61 +300,105 @@ session_rules_table_alloc_rule_40 (mma_rules_table_40_t * srt,
   return rule;
 }
 
+/**
+ * Add/delete session rule
+ *
+ * @param srt table where rule should be added
+ * @param args rule arguments
+ *
+ * @return 0 if success, clib_error_t error otherwise
+ */
 clib_error_t *
 session_rules_table_add_del (session_rules_table_t * srt,
 			     session_rule_table_add_del_args_t * args)
 {
   u8 fib_proto = args->rmt.fp_proto;
+  u32 ri_from_tag, ri;
+  int rv;
 
-  if (args->transport_proto != TRANSPORT_PROTO_TCP
-      && args->transport_proto != TRANSPORT_PROTO_UDP)
+  ri_from_tag = session_rules_table_rule_for_tag (srt, args->tag);
+  if (args->is_add && ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
     return clib_error_return_code (0, VNET_API_ERROR_INVALID_VALUE, 0,
-				   "invalid transport proto");
+				   "tag exists");
 
   if (fib_proto == FIB_PROTOCOL_IP4)
     {
       mma_rules_table_16_t *srt4;
-      srt4 = &srt->session_rules_tables_16[args->transport_proto];
+      srt4 = &srt->session_rules_tables_16;
       if (args->is_add)
 	{
-	  mma_rule_16_t *rule;
-	  rule = session_rules_table_alloc_rule_16 (srt4, &args->lcl,
-						    args->lcl_port,
-						    &args->rmt,
-						    args->rmt_port);
-	  rule->action_index = args->action_index;
-	  mma_rules_table_add_rule_16 (srt4, rule);
+	  mma_rule_16_t *rule4;
+	  rule4 = session_rules_table_alloc_rule_16 (srt4, &args->lcl,
+						     args->lcl_port,
+						     &args->rmt,
+						     args->rmt_port);
+	  rule4->action_index = args->action_index;
+	  rv = mma_rules_table_add_rule_16 (srt4, rule4);
+	  if (!rv)
+	    {
+	      ri = mma_rules_table_rule_index_16 (srt4, rule4);
+	      session_rules_table_add_del_tag (srt, args->tag, ri, 1, 1);
+	    }
 	}
       else
 	{
-	  mma_rule_16_t rule;
-	  memset (&rule, 0, sizeof (rule));
-	  session_rules_table_init_rule_16 (&rule, &args->lcl, args->lcl_port,
-					    &args->rmt, args->rmt_port);
-	  mma_rules_table_del_rule_16 (srt4, &rule, srt4->root_index);
+	  mma_rule_16_t *rule;
+	  if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
+	    {
+	      rule = mma_rules_table_get_rule_16 (srt4, ri_from_tag);
+	      mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
+	      session_rules_table_add_del_tag (srt, args->tag, 0, 1, 0);
+	    }
+	  else
+	    {
+	      mma_rule_16_t _rule;
+	      rule = &_rule;
+	      memset (rule, 0, sizeof (*rule));
+	      session_rules_table_init_rule_16 (rule, &args->lcl,
+						args->lcl_port, &args->rmt,
+						args->rmt_port);
+	      mma_rules_table_del_rule_16 (srt4, rule, srt4->root_index);
+	    }
 	}
     }
   else if (fib_proto == FIB_PROTOCOL_IP6)
     {
       mma_rules_table_40_t *srt6;
-      mma_rule_40_t *rule;
-      srt6 = &srt->session_rules_tables_40[args->transport_proto];
+      mma_rule_40_t *rule6;
+      srt6 = &srt->session_rules_tables_40;
       if (args->is_add)
 	{
-	  rule = session_rules_table_alloc_rule_40 (srt6, &args->lcl,
-						    args->lcl_port,
-						    &args->rmt,
-						    args->rmt_port);
-	  rule->action_index = args->action_index;
-	  mma_rules_table_add_rule_40 (srt6, rule);
+	  rule6 = session_rules_table_alloc_rule_40 (srt6, &args->lcl,
+						     args->lcl_port,
+						     &args->rmt,
+						     args->rmt_port);
+	  rule6->action_index = args->action_index;
+	  rv = mma_rules_table_add_rule_40 (srt6, rule6);
+	  if (!rv)
+	    {
+	      ri = mma_rules_table_rule_index_40 (srt6, rule6);
+	      session_rules_table_add_del_tag (srt, args->tag, ri, 0, 1);
+	    }
 	}
       else
 	{
-	  mma_rule_40_t rule;
-	  memset (&rule, 0, sizeof (rule));
-	  session_rules_table_init_rule_40 (&rule, &args->lcl, args->lcl_port,
-					    &args->rmt, args->rmt_port);
-	  mma_rules_table_del_rule_40 (srt6, &rule, srt6->root_index);
+	  mma_rule_40_t *rule;
+	  if (ri_from_tag != SESSION_RULES_TABLE_INVALID_INDEX)
+	    {
+	      rule = mma_rules_table_get_rule_40 (srt6, ri_from_tag);
+	      mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
+	      session_rules_table_add_del_tag (srt, args->tag, 0, 0, 0);
+	    }
+	  else
+	    {
+	      mma_rule_40_t _rule;
+	      rule = &_rule;
+	      memset (rule, 0, sizeof (*rule));
+	      session_rules_table_init_rule_40 (rule, &args->lcl,
+						args->lcl_port, &args->rmt,
+						args->rmt_port);
+	      mma_rules_table_del_rule_40 (srt6, rule, srt6->root_index);
+	    }
 	}
     }
   else
@@ -272,36 +408,34 @@ session_rules_table_add_del (session_rules_table_t * srt,
 }
 
 u32
-session_rules_table_lookup4 (session_rules_table_t * srt, u8 transport_proto,
+session_rules_table_lookup4 (session_rules_table_t * srt,
 			     ip4_address_t * lcl_ip, ip4_address_t * rmt_ip,
 			     u16 lcl_port, u16 rmt_port)
 {
-  mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16[transport_proto];
+  mma_rules_table_16_t *srt4 = &srt->session_rules_tables_16;
   session_mask_or_match_4_t key = {
     .lcl_ip.as_u32 = lcl_ip->as_u32,
     .rmt_ip.as_u32 = rmt_ip->as_u32,
     .lcl_port = lcl_port,
     .rmt_port = rmt_port,
   };
-  return mma_rules_table_lookup_16 (srt4,
-				    (mma_mask_or_match_16_t *) & key,
+  return mma_rules_table_lookup_16 (srt4, (mma_mask_or_match_16_t *) & key,
 				    srt4->root_index);
 }
 
 u32
-session_rules_table_lookup6 (session_rules_table_t * srt, u8 transport_proto,
+session_rules_table_lookup6 (session_rules_table_t * srt,
 			     ip6_address_t * lcl_ip, ip6_address_t * rmt_ip,
 			     u16 lcl_port, u16 rmt_port)
 {
-  mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40[transport_proto];
+  mma_rules_table_40_t *srt6 = &srt->session_rules_tables_40;
   session_mask_or_match_6_t key = {
     .lcl_port = lcl_port,
     .rmt_port = rmt_port,
   };
   clib_memcpy (&key.lcl_ip, lcl_ip, sizeof (*lcl_ip));
   clib_memcpy (&key.rmt_ip, rmt_ip, sizeof (*rmt_ip));
-  return mma_rules_table_lookup_40 (srt6,
-				    (mma_mask_or_match_40_t *) & key,
+  return mma_rules_table_lookup_40 (srt6, (mma_mask_or_match_40_t *) & key,
 				    srt6->root_index);
 }
 
@@ -313,36 +447,32 @@ session_rules_table_init (session_rules_table_t * srt)
   mma_rule_16_t *rule4;
   mma_rule_40_t *rule6;
   fib_prefix_t null_prefix;
-  int i;
 
   memset (&null_prefix, 0, sizeof (null_prefix));
 
-  for (i = 0; i < TRANSPORT_N_PROTO; i++)
-    {
-      srt4 = &srt->session_rules_tables_16[i];
-      rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0,
-						 &null_prefix, 0);
-      rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
-      srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4);
-      srt4->rule_cmp_fn = rule_cmp_16;
-    }
-
-  for (i = 0; i < TRANSPORT_N_PROTO; i++)
-    {
-      srt6 = &srt->session_rules_tables_40[i];;
-      rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0,
-						 &null_prefix, 0);
-      rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
-      srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6);
-      srt6->rule_cmp_fn = rule_cmp_40;
-    }
+  srt4 = &srt->session_rules_tables_16;
+  rule4 = session_rules_table_alloc_rule_16 (srt4, &null_prefix, 0,
+					     &null_prefix, 0);
+  rule4->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
+  srt4->root_index = mma_rules_table_rule_index_16 (srt4, rule4);
+  srt4->rule_cmp_fn = rule_cmp_16;
+
+  srt6 = &srt->session_rules_tables_40;
+  rule6 = session_rules_table_alloc_rule_40 (srt6, &null_prefix, 0,
+					     &null_prefix, 0);
+  rule6->action_index = SESSION_RULES_TABLE_INVALID_INDEX;
+  srt6->root_index = mma_rules_table_rule_index_40 (srt6, rule6);
+  srt6->rule_cmp_fn = rule_cmp_40;
+
+  srt->rules_by_tag = hash_create_vec (0, sizeof (u8), sizeof (uword));
+  srt->tags_by_rules = hash_create (0, sizeof (uword));
 }
 
 void
 session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt,
-			       u8 transport_proto, ip46_address_t * lcl_ip,
-			       u16 lcl_port, ip46_address_t * rmt_ip,
-			       u16 rmt_port, u8 is_ip4)
+			       ip46_address_t * lcl_ip, u16 lcl_port,
+			       ip46_address_t * rmt_ip, u16 rmt_port,
+			       u8 is_ip4)
 {
   mma_rules_table_16_t *srt4;
   mma_rules_table_40_t *srt6;
@@ -352,7 +482,7 @@ session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt,
 
   if (is_ip4)
     {
-      srt4 = session_rules_table_get (srt, transport_proto, FIB_PROTOCOL_IP4);
+      srt4 = session_rules_table_get (srt, FIB_PROTOCOL_IP4);
       session_mask_or_match_4_t key = {
 	.lcl_ip.as_u32 = lcl_ip->ip4.as_u32,
 	.rmt_ip.as_u32 = rmt_ip->ip4.as_u32,
@@ -364,41 +494,39 @@ session_rules_table_show_rule (vlib_main_t * vm, session_rules_table_t * srt,
 					(mma_mask_or_match_16_t *) & key,
 					srt4->root_index);
       sr4 = mma_rules_table_get_rule_16 (srt4, ri);
-      vlib_cli_output (vm, "%U", format_session_rule4, srt4, sr4);
+      vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
     }
   else
     {
-      srt6 = session_rules_table_get (srt, transport_proto, FIB_PROTOCOL_IP6);
+      srt6 = session_rules_table_get (srt, FIB_PROTOCOL_IP6);
       session_mask_or_match_6_t key = {
 	.lcl_port = lcl_port,
 	.rmt_port = rmt_port,
       };
       clib_memcpy (&key.lcl_ip, &lcl_ip->ip6, sizeof (lcl_ip->ip6));
       clib_memcpy (&key.rmt_ip, &rmt_ip->ip6, sizeof (rmt_ip->ip6));
-      ri =
-	mma_rules_table_lookup_rule_40 (srt6,
-					(mma_mask_or_match_40_t *) &
-					key, srt6->root_index);
+      ri = mma_rules_table_lookup_rule_40 (srt6,
+					   (mma_mask_or_match_40_t *) & key,
+					   srt6->root_index);
       sr6 = mma_rules_table_get_rule_40 (srt6, ri);
-      vlib_cli_output (vm, "%U", format_session_rule6, srt6, sr6);
+      vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
     }
 }
 
 void
 session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt,
-			      u8 fib_proto, u8 transport_proto)
+			      u8 fib_proto)
 {
   if (fib_proto == FIB_PROTOCOL_IP4)
     {
       mma_rules_table_16_t *srt4;
       mma_rule_16_t *sr4;
-      srt4 = &srt->session_rules_tables_16[transport_proto];
-      vlib_cli_output (vm, "%U IP4 rules table", format_transport_proto,
-		       transport_proto);
+      srt4 = &srt->session_rules_tables_16;
+      vlib_cli_output (vm, "IP4 rules");
 
       /* *INDENT-OFF* */
       pool_foreach(sr4, srt4->rules, ({
-	vlib_cli_output (vm, "%U", format_session_rule4, srt4, sr4);
+	vlib_cli_output (vm, "%U", format_session_rule4, srt, sr4);
       }));
       /* *INDENT-ON* */
 
@@ -407,13 +535,12 @@ session_rules_table_cli_dump (vlib_main_t * vm, session_rules_table_t * srt,
     {
       mma_rules_table_40_t *srt6;
       mma_rule_40_t *sr6;
-      srt6 = &srt->session_rules_tables_40[transport_proto];
-      vlib_cli_output (vm, "\n%U IP6 rules table", format_transport_proto,
-		       transport_proto);
+      srt6 = &srt->session_rules_tables_40;
+      vlib_cli_output (vm, "IP6 rules");
 
       /* *INDENT-OFF* */
       pool_foreach(sr6, srt6->rules, ({
-        vlib_cli_output (vm, "%U", format_session_rule6, srt6, sr6);
+        vlib_cli_output (vm, "%U", format_session_rule6, srt, sr6);
       }));
       /* *INDENT-ON* */
 
diff --git a/src/vnet/session/session_rules_table.h b/src/vnet/session/session_rules_table.h
index 27b0f8856f5..9bab61e7539 100644
--- a/src/vnet/session/session_rules_table.h
+++ b/src/vnet/session/session_rules_table.h
@@ -54,50 +54,67 @@ typedef CLIB_PACKED (struct
 }) session_mask_or_match_6_t;
 /* *INDENT-ON* */
 
+#define SESSION_RULE_TAG_MAX_LEN 64
+#define SESSION_RULES_TABLE_ACTION_DROP (((u32)~0) - 1)
+#define SESSION_RULES_TABLE_INVALID_INDEX MMA_TABLE_INVALID_INDEX
+
 typedef struct _session_rules_table_add_del_args
 {
-  u8 transport_proto;
   fib_prefix_t lcl;
   fib_prefix_t rmt;
   u16 lcl_port;
   u16 rmt_port;
   u32 action_index;
+  u8 *tag;
   u8 is_add;
 } session_rule_table_add_del_args_t;
 
-#define SESSION_RULES_TABLE_ACTION_DROP (((u32)~0) - 1)
+typedef struct _rule_tag
+{
+  u8 *tag;
+} session_rule_tag_t;
 
 typedef struct _session_rules_table_t
 {
   /**
-   * Per fib proto and transport proto session rules tables
+   * Per fib proto session rules tables
+   */
+  mma_rules_table_16_t session_rules_tables_16;
+  mma_rules_table_40_t session_rules_tables_40;
+  /**
+   * Hash table that maps tags to rules
+   */
+  uword *rules_by_tag;
+  /**
+   * Pool of rules tags
+   */
+  session_rule_tag_t *rule_tags;
+  /**
+   * Hash table that maps rule indices to tags
    */
-  mma_rules_table_16_t session_rules_tables_16[TRANSPORT_N_PROTO];
-  mma_rules_table_40_t session_rules_tables_40[TRANSPORT_N_PROTO];
+  uword *tags_by_rules;
 } session_rules_table_t;
 
-void *session_rules_table_get (session_rules_table_t * srt,
-			       u8 transport_proto, u8 fib_proto);
 u32 session_rules_table_lookup4 (session_rules_table_t * srt,
-				 u8 transport_proto, ip4_address_t * lcl_ip,
+				 ip4_address_t * lcl_ip,
 				 ip4_address_t * rmt_ip, u16 lcl_port,
 				 u16 rmt_port);
 u32 session_rules_table_lookup6 (session_rules_table_t * srt,
-				 u8 transport_proto, ip6_address_t * lcl_ip,
+				 ip6_address_t * lcl_ip,
 				 ip6_address_t * rmt_ip, u16 lcl_port,
 				 u16 rmt_port);
 void session_rules_table_cli_dump (vlib_main_t * vm,
-				   session_rules_table_t * srt, u8 fib_proto,
-				   u8 transport_proto);
+				   session_rules_table_t * srt, u8 fib_proto);
 void session_rules_table_show_rule (vlib_main_t * vm,
 				    session_rules_table_t * srt,
-				    u8 transport_proto,
 				    ip46_address_t * lcl_ip, u16 lcl_port,
 				    ip46_address_t * rmt_ip, u16 rmt_port,
 				    u8 is_ip4);
 clib_error_t *session_rules_table_add_del (session_rules_table_t * srt,
 					   session_rule_table_add_del_args_t *
 					   args);
+u8 *session_rules_table_rule_tag (session_rules_table_t * srt, u32 ri,
+				  u8 is_ip4);
 void session_rules_table_init (session_rules_table_t * srt);
 #endif /* SRC_VNET_SESSION_SESSION_RULES_TABLE_H_ */
 /*
diff --git a/src/vnet/session/session_table.c b/src/vnet/session/session_table.c
index f0bd338ec64..5d160a4b2dc 100644
--- a/src/vnet/session/session_table.c
+++ b/src/vnet/session/session_table.c
@@ -70,6 +70,7 @@ void
 session_table_init (session_table_t * slt, u8 fib_proto)
 {
   u8 all = fib_proto > FIB_PROTOCOL_IP6 ? 1 : 0;
+  int i;
 
 #define _(af,table,parm,value) 						\
   u32 configured_##af##_##table##_table_##parm = value;
@@ -101,7 +102,9 @@ session_table_init (session_table_t * slt, u8 fib_proto)
 			     configured_v6_halfopen_table_buckets,
 			     configured_v6_halfopen_table_memory);
     }
-  session_rules_table_init (&slt->session_rules);
+
+  for (i = 0; i < TRANSPORT_N_PROTO; i++)
+    session_rules_table_init (&slt->session_rules[i]);
 }
 
 typedef struct _ip4_session_table_walk_ctx_t
diff --git a/src/vnet/session/session_table.h b/src/vnet/session/session_table.h
index 6cf815991a9..636ee44a2fe 100644
--- a/src/vnet/session/session_table.h
+++ b/src/vnet/session/session_table.h
@@ -37,7 +37,7 @@ typedef struct _session_lookup_table
   /**
    * Per fib proto and transport proto session rules tables
    */
-  session_rules_table_t session_rules;
+  session_rules_table_t session_rules[TRANSPORT_N_PROTO];
 
   /** Flag that indicates if table has local scope */
   u8 is_local;
diff --git a/src/vnet/session/session_test.c b/src/vnet/session/session_test.c
index a3e76c25539..8d18619067f 100644
--- a/src/vnet/session/session_test.c
+++ b/src/vnet/session/session_test.c
@@ -506,8 +506,7 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
 		action_index - 1);
 
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 1),
 		"Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 1: %d",
 		res);
@@ -561,8 +560,7 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
    * and  3.3.3.3 1234 7.7.7.7 4321
    */
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 3),
 		"Lookup 1.2.3.4 1234 5.6.7.8 4321 action " "should be 3: %d",
 		res);
@@ -570,15 +568,14 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
   lcl_lkup.as_u32 = clib_host_to_net_u32 (0x01020204);
   rmt_lkup.as_u32 = clib_host_to_net_u32 (0x05060709);
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_lkup,
+    session_rules_table_lookup4 (srt, &lcl_lkup,
 				 &rmt_lkup, lcl_port, rmt_port);
   SESSION_TEST ((res == 1),
 		"Lookup 1.2.2.4 1234 5.6.7.9 4321, action " "should be 1: %d",
 		res);
 
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip3, &rmt_ip3,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip3, &rmt_ip3, lcl_port, rmt_port);
   SESSION_TEST ((res == 6),
 		"Lookup 3.3.3.3 1234 7.7.7.7 4321, action "
 		"should be 6 (updated): %d", res);
@@ -598,13 +595,12 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
   SESSION_TEST ((error == 0), "Add 1.2.3.4/24 * 5.6.7.8/24 * action %d",
 		action_index - 1);
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 7),
 		"Lookup 1.2.3.4 1234 5.6.7.8 4321, action should"
 		" be 7 (lpm dst): %d", res);
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip,
 				 lcl_port + 1, rmt_port);
   SESSION_TEST ((res == 7),
 		"Lookup 1.2.3.4 1235 5.6.7.8 4321, action should " "be 7: %d",
@@ -645,23 +641,21 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
 		action_index - 1);
 
   if (verbose)
-    session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4,
-				  TRANSPORT_PROTO_TCP);
+    session_rules_table_cli_dump (vm, srt, FIB_PROTOCOL_IP4);
 
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 3),
 		"Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d",
 		res);
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip,
 				 lcl_port + 1, rmt_port);
   SESSION_TEST ((res == 9),
 		"Lookup 1.2.3.4 1235 5.6.7.8 4321, action should " "be 9: %d",
 		res);
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip,
 				 lcl_port + 1, rmt_port + 1);
   SESSION_TEST ((res == 8),
 		"Lookup 1.2.3.4 1235 5.6.7.8 4322, action should " "be 8: %d",
@@ -679,8 +673,7 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
   error = session_rules_table_add_del (srt, &args);
   SESSION_TEST ((error == 0), "Del 1.2.0.0/16 1234 5.6.0.0/16 4321");
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 3),
 		"Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d",
 		res);
@@ -691,8 +684,7 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
   error = session_rules_table_add_del (srt, &args);
   SESSION_TEST ((error == 0), "Del 1.2.0.0/16 * 5.6.0.0/16 *");
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 3),
 		"Lookup 1.2.3.4 1234 5.6.7.8 4321, action should " "be 3: %d",
 		res);
@@ -710,8 +702,7 @@ session_test_rule_table (vlib_main_t * vm, unformat_input_t * input)
   error = session_rules_table_add_del (srt, &args);
   SESSION_TEST ((error == 0), "Del 1.2.3.4/24 1234 5.6.7.5/24");
   res =
-    session_rules_table_lookup4 (srt, TRANSPORT_PROTO_TCP, &lcl_ip, &rmt_ip,
-				 lcl_port, rmt_port);
+    session_rules_table_lookup4 (srt, &lcl_ip, &rmt_ip, lcl_port, rmt_port);
   SESSION_TEST ((res == 2), "Action should be 2: %d", res);
 
   return 0;
@@ -959,6 +950,32 @@ session_test_rules (vlib_main_t * vm, unformat_input_t * input)
 				      &rmt_pref.fp_addr.ip4, lcl_port,
 				      rmt_port, TRANSPORT_PROTO_TCP, 0);
   SESSION_TEST ((tc == 0), "optimized lookup should not work (no-rule)");
+
+  /*
+   * Test tags. Add/del rule with tag
+   */
+  args.table_args.is_add = 1;
+  args.table_args.lcl_port = 1234;
+  args.table_args.lcl.fp_addr.ip4 = lcl_ip;
+  args.table_args.lcl.fp_len = 16;
+  args.table_args.rmt.fp_addr.ip4 = rmt_ip;
+  args.table_args.rmt.fp_len = 16;
+  args.table_args.tag = format (0, "test_rule");
+  error = vnet_session_rule_add_del (&args);
+  SESSION_TEST ((error == 0), "Add 1.2.3.4/16 1234 5.6.7.8/16 4321 drop "
+		"tag test_rule");
+  if (verbose)
+    {
+      session_lookup_dump_rules_table (0, FIB_PROTOCOL_IP4,
+				       TRANSPORT_PROTO_TCP);
+      session_lookup_dump_local_rules_table (0, FIB_PROTOCOL_IP4,
+					     TRANSPORT_PROTO_TCP);
+    }
+  args.table_args.is_add = 0;
+  args.table_args.lcl_port += 1;
+  SESSION_TEST ((error == 0), "Del 1.2.3.4/32 1234 5.6.7.8/32 4321 drop "
+		"tag test_rule");
+
   return 0;
 }