Re: [libvirt] Libvirt and IPSec

Hi Michal! Due to reduce the implementation time and verify quickly if our project is feasible, we decided to implement the prototype by using the simplest user-space applications (VTun, Open vSwitch). To increase the security, we would like to move in kernel-space all security components. We want to migrate from user to kernel space not by defining new kernel modules or by modifying the existing ones, but by using already defined applications that perform our security requirements in kernel spaces. For instance, we have defined an application which filters all received packets (by analyzing the VLAN tags) before that they are received by the switch. We think that the filtering may be executed by using the SELinux labels. About tunneling, we want to remove VTun from our framework and setup directly the 'gretap' interfaces. Any other questions are welcomed! Paolo