Network device data plane sandboxes for third-party controlled packet forwarding paths

1. A method comprising:

configuring, by a first application executed by a control plane of a network device and via a first interface executed by a forwarding unit of the network device, an internal forwarding path of the forwarding unit with a sandbox that comprises a container for instructions to be configured inline within the internal forwarding path, and

wherein at least a portion of the internal forwarding path is stored to a memory of the forwarding unit and is executable by a packet processor of the forwarding unit;

configuring, by the first application, a socket for the sandbox;

configuring, by a second application executed by the control plane of the network device and via a second interface executed by the forwarding unit of the network device, the sandbox with instructions for the sandbox; and

processing, by the packet processor, a packet received by the forwarding unit using the instructions for the sandbox to cause the forwarding unit to send the packet to the second application via the socket.

2. The method of claim 1 , further comprising:

processing, by the second application, the packet to obtain a processed packet; and

sending, by the second application, the processed packet to the forwarding unit via the socket.

3. The method of claim 1 , wherein the packet comprises a first packet, the method further comprising:

receiving, by the packet processor from the second application and via the socket, a second packet; and

processing, by the packet processor, the second packet using the instructions for the sandbox.

4. The method of claim 1 , wherein the socket comprises a network socket.

5. The method of claim 1 ,

wherein the instructions for the sandbox comprise a match-and-receive instruction, and

wherein processing the packet received by the forwarding unit using the instructions for the sandbox comprises:

determining, by the packet processor, the packet matches the match-and-receive instruction;

sending, by the forwarding unit in response to the determining, the packet to the second application via the socket.

6. The method of claim 1 , further comprising:

sending, by the second interface of the forwarding unit, the packet to the second application via the socket.

7. The method of claim 1 , further comprising:

executing, by a forwarding unit processor of the forwarding unit, the second interface and the socket.

8. The method of claim 1 , wherein the second application applies, to the packet, a service of at least one service chain.

9. The method of claim 1 , wherein the forwarding unit comprises a line card insertable within a chassis of the network device.

10. The method of claim 1 , wherein configuring the internal forwarding path with the sandbox comprises configuring, by the first application, an ingress port for the sandbox that defines a virtual port by which at least one instruction of the internal forwarding path resolves to the sandbox.

11. The method of claim 10 , further comprising:

configuring, by the first application, the internal forwarding path to map a logical inbound interface of the forwarding unit to the ingress port for the sandbox,

wherein processing the packet received by the forwarding unit using the instructions for the sandbox comprises processing, by the packet processor in response to determining the packet is received by the forwarding unit at the inbound logical interface, the packet using the instructions for the sandbox.

12. The method of claim 10 ,

wherein the ingress port comprises an indirect next hop that includes a reference,

wherein configuring the ingress port comprises storing, by the first interface, the indirect next hop to the memory,

wherein configuring the sandbox with the instructions for the sandbox comprises configuring, by the second interface, the reference of the indirect next hop to reference a forwarding path element configured in the sandbox.

13. The method of claim 1 , wherein configuring the internal forwarding path with the sandbox comprises configuring, by the first application, an egress port for the sandbox that defines a virtual port by which at least one instruction of the internal forwarding path resolve to exit the sandbox.

14. A network device comprising:

a control plane configured to execute a first application and a second application; and

a forwarding unit comprising:

an interface card;

a packet processor operably coupled to a memory;

an internal forwarding path, wherein at least a portion of the internal forwarding path is stored to the memory and is executable by the packet processor;

a forwarding unit processor; and

a first interface and a second interface configured for execution by the forwarding unit processor,

wherein the first application is configured to configure, via the first interface, the internal forwarding path with a sandbox that comprises a container for instructions to be configured inline within the internal forwarding path,

wherein the first application is configured to configure a socket for the sandbox,

wherein the second application is configured to configure, via the second interface, the sandbox with instructions for the sandbox, and

wherein the packet processor is configured to process a packet received by the interface card using the instructions for the sandbox to cause the forwarding unit to send the packet to the second application via the socket.

15. The network device of claim 14 ,

wherein the second application is configured to process the packet to obtain a processed packet; and

wherein the second application is configured to send the processed packet to the forwarding unit via the socket.

16. The network device of claim 14 ,

wherein the packet comprises a first packet,

wherein the packet processor is configured to receive, from the second application and via the socket, a second packet, and

wherein the packet processor is configured to process the second packet using the instructions for the sandbox.

17. The network device of claim 14 , wherein to configure the internal forwarding path with the sandbox the first application is configured to configure an ingress port for the sandbox that defines a virtual port by which at least one instruction of the internal forwarding path resolves to the sandbox.

18. The network device of claim 14 ,

wherein the first application is configured to configure the internal forwarding path to map a logical inbound interface of the forwarding unit to the ingress port for the sandbox,

wherein to process the packet received by the forwarding unit using the instructions for the sandbox, the packet processor is configured to process, in response to a determination the packet is received by the forwarding unit at the inbound logical interface, the packet using the instructions for the sandbox.

19. The network device of claim 14 , wherein the forwarding unit comprises a line card insertable within a chassis of the network device.

20. A non-transitory computer-readable medium comprising instructions for causing one or more programmable processors of a network device to:

configure, by a first application executed by a control plane of the network device and via a first interface executed by a forwarding unit of the network device, an internal forwarding path of the forwarding unit with a sandbox that comprises a container for instructions to be configured inline within the internal forwarding path, and

wherein at least a portion of the internal forwarding path is stored to a memory of the forwarding unit and is executable by a packet processor of the forwarding unit;

configure, by the first application, a socket for the sandbox;

configure, by a second application executed by the control plane of the network device and via a second interface executed by the forwarding unit of the network device, the sandbox with instructions for the sandbox; and

process, by the packet processor, a packet received by the forwarding unit using the instructions for the sandbox to cause the forwarding unit to send the packet to the second application via the socket.