Re: [libvirt] Libvirt and IPSec

2011-05-02 Thread Michal Novotny
On 04/29/2011 06:13 PM, Paolo Smiraglia wrote: Hi to everyone! Sorry for the latency of the response but me and my team we are noticed that the TVD argument can not be treated only with a few lines in some mails. In order to avoid any possible misunderstanding, we decided to produce a little

Re: [libvirt] Libvirt and IPSec

2011-05-02 Thread Paolo Smiraglia
Hi Paolo, thanks for the document. I read it briefly and the design itself seems good however in the document you mentioned moving the logic from user-space to kernel-space which I'm not sure how would you like to achieve this since libvirt itself is in the user-space stack and not

Re: [libvirt] Libvirt and IPSec

2011-05-02 Thread Michal Novotny
On 05/02/2011 03:12 PM, Paolo Smiraglia wrote: Hi Michal! Due to reduce the implementation time and verify quickly if our project is feasible, we decided to implement the prototype by using the simplest user-space applications (VTun, Open vSwitch). To increase the security, we would like to

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-05-02 Thread Paolo Smiraglia
Also I'm still curious about my questions in my earlier response to you: https://www.redhat.com/archives/libvir-list/2011-April/msg00589.html in particular: 1) does the network on each host always have a forward ... element for forwarding local traffic directly out to the public

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-05-02 Thread Paolo Smiraglia
Paolo, Did you see my recent email titled RFC: disconnecting guest/domain interface config from host config: https://www.redhat.com/archives/libvir-list/2011-April/msg00591.html We both want to expand the usage of network, so we'd do well to avoid stepping on each others' toes!

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-29 Thread Paolo Smiraglia
Hi to everyone! Sorry for the latency of the response but me and my team we are noticed that the TVD argument can not be treated only with a few lines in some mails. In order to avoid any possible misunderstanding, we decided to produce a little report (just four pages with images) that describes

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-29 Thread Laine Stump
On 04/29/2011 12:13 PM, Paolo Smiraglia wrote: Hi to everyone! Sorry for the latency of the response but me and my team we are noticed that the TVD argument can not be treated only with a few lines in some mails. In order to avoid any possible misunderstanding, we decided to produce a little

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-29 Thread Laine Stump
On 04/29/2011 01:32 PM, Laine Stump wrote: On 04/29/2011 12:13 PM, Paolo Smiraglia wrote: Hi to everyone! Sorry for the latency of the response but me and my team we are noticed that the TVD argument can not be treated only with a few lines in some mails. In order to avoid any possible

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-12 Thread Michal Novotny
On 04/06/2011 03:10 PM, Paolo Smiraglia wrote: Hi to everyone! First of all, sorry for the thread subject change. Due to the several issues of the Libvirt implementation of the Trusted Virtual Domains (TVD), I decided to approach the topic in a modular manner. Hi Paolo, so basically this is

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-12 Thread Paolo Smiraglia
Hi Michael! Thanks for the reply. Comments are inline. Hi Paolo, so basically this is about IPSec driver implementation to the libvirt ? Exactly... I don't think the idea is bad however I'm not working on libvirt too much so you should ask libvirt guys about they opinion. Since I think

Re: [libvirt] Libvirt and IPSec

2011-04-12 Thread Michal Novotny
On 04/12/2011 01:23 PM, Paolo Smiraglia wrote: Hi Michael! Thanks for the reply. Comments are inline. Hi Paolo, so basically this is about IPSec driver implementation to the libvirt ? Exactly... Ok, right. I don't know much about IPSec itself so some study on the matter would be necessary

Re: [libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-12 Thread Laine Stump
On 04/06/2011 09:10 AM, Paolo Smiraglia wrote: Hi to everyone! First of all, sorry for the thread subject change. Due to the several issues of the Libvirt implementation of the Trusted Virtual Domains (TVD), I decided to approach the topic in a modular manner. I think that the first step

[libvirt] Libvirt and IPSec (was: What about Trusted Virtual Domains???)

2011-04-06 Thread Paolo Smiraglia
Hi to everyone! First of all, sorry for the thread subject change. Due to the several issues of the Libvirt implementation of the Trusted Virtual Domains (TVD), I decided to approach the topic in a modular manner. I think that the first step should be to define the IPSec support or, more in