Is there any method by which KVM in conjunction with Netlabel or other labeling function can be configured such that  a statically configured label

•  is added for all outgoing network traffic generated by a specific Windows Guest OS instance
• is verified and then removed for all incoming network traffic delivered to a specific Windows Guest OS instance

in a manner which is transparent to Windows and Windows applications?