RFC 5553
Resource Reservation Protocol (RSVP) Extensions for Path Key Support
Network Working Group 🌸
- Request for Comments: 5553 (the RSVP path key RFC, no cap 🎀)
- Authors: A. Farrel, Ed. (Old Dog Consulting), R. Bradford and JP. Vasseur (Cisco Systems, Inc.)
- Category: Standards Track
- Date: May 2009
- Obsoletes/Updates: The title block doesn't list anything this RFC obsoletes or updates.
Resource Reservation Protocol (RSVP) Extensions for Path Key Support 💖
Status of This Memo 📜
Okay so this document is an Internet standards track protocol for the Internet community 🌐, and it's literally asking people for discussion and suggestions for improvements. If you want the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💅.
Copyright Notice ©️
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved 🔒.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, as they're in effect on the date of publication. Read them carefully, bestie, because they spell out your rights and restrictions with respect to this document: http://trustee.ietf.org/license-info.
This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people controlling the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. So unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The exception is formatting it for publication as an RFC, or translating it into languages other than English 🌈.
Abstract 🦋
The paths taken by Multiprotocol Label Switching (MPLS) and Generalized MPLS (GMPLS) Traffic Engineering (TE) Label Switched Paths (LSPs) may be computed by Path Computation Elements (PCEs). When the TE LSP crosses multiple domains, like Autonomous Systems (ASes), the path may be computed by multiple PCEs working together, with each one responsible for computing a segment of the path 🤝.
To keep the topology inside each AS confidential, the PCEs can hide the contents of a path segment (like the segment that goes through an AS). That hidden piece is called the Confidential Path Segment (CPS). The PCEs do this by encoding the contents as a Path Key Subobject (PKS) and embedding that subobject inside the result of their path computation 🔐.
This document explains how to carry Path Key Subobjects in the Resource Reservation Protocol (RSVP) Explicit Route Objects (EROs) and Record Route Objects (RROs). The whole point is to keep things confidential during the signaling of inter-domain TE LSPs 🧚.
1. Introduction 🎀
Okay, MPLS and GMPLS Traffic Engineering (TE) Label Switched Paths (LSPs) get signaled using the TE extensions to the Resource Reservation Protocol (RSVP-TE) [RFC3209], [RFC3473]. The routes those LSPs follow may be computed by Path Computation Elements (PCEs) [RFC4655] ✨.
When the TE LSP crosses multiple domains [RFC4726], like Autonomous Systems (ASes), several PCEs may cooperate to compute the path, with each one handling a segment of it. To keep topology confidential within each AS, the PCE Communications Protocol (PCEP) [RFC5440] supports a mechanism that hides the contents of a path segment. That hidden segment is called the Confidential Path Segment (CPS), and its contents are encoded as a Path Key Subobject (PKS) [RFC5520] 🫶.
This document defines the RSVP-TE protocol extensions needed to use Path Key Subobjects in MPLS and GMPLS signaling. You include them in Explicit Route Objects (EROs) and Record Route Objects (RROs), and that's how you keep the signaling of inter-domain TE LSPs confidential 🔐💅.
1.1. Conventions Used in This Document 📝
Here's the tea 🍵: the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. Those words are the ones that really matter, so keep an eye out for them 👀.
1.2. Usage Scenario 🗺️
Figure 1 shows a simple network made of two ASes. Someone wants an LSP from the ingress in AS-1 to the egress in AS-2 💭. As described in [RFC4655], the ingress Label Switching Router (LSR) acts as a Path Computation Client (PCC) and sends a request to its PCE (PCE-1). PCE-1 can compute the path within AS-1, but it has zero visibility into AS-2. So PCE-1 teams up with PCE-2 to finish the path computation 🤓.
PCE-2 doesn't want to share information about the path across AS-2 with anything outside the AS, and honestly that's valid 🙅♀️. So, as described in [RFC5520], PCE-2 reports the AS-2 path segment using a PKS instead of the explicit details of the path.
PCE-1 can now return the path to be signaled to the ingress LSR. The AS-2 segment is still hidden as a PKS in that path computation response 🙈.
To set up the LSP, the ingress LSR signals using RSVP-TE and encodes the path reported by PCE-1 in the Explicit Route Object (ERO). This is normal RSVP-TE, but the PKS also has to be included in the ERO, using the mechanisms defined in this document 💖.
When the signaling message (the RSVP-TE Path message) reaches ASBR-2 (Autonomous System Border Router), ASBR-2 consults PCE-2 to 'decode' the PKS and get back the expanded explicit path segment. (The information PCE-2 uses to decode the PKS is encoded within the PKS itself 🧠.) The PKS then gets replaced in the ERO with the expanded information about the path ✨.
----------------------------- ----------------------------
| AS-1 | | AS-2 |
| | | |
| ------- | | ------- |
| | PCE-1 |<---------------+--+-->| PCE-2 | |
| ------- | | ------- |
| ^ | | ^ |
| | | | | |
| v | | v |
| ------- ---- | | ---- |
| | PCC | - - |ASBR| | | |ASBR| - - ------ |
| |Ingress|--|A|--|B|--| 1 |-+--+-| 2 |--|C|--|D|--|Egress| |
| ------- - - ----- | | ---- - - ------ |
| | | |
----------------------------- ----------------------------
Figure 1: A Simple Network to Demonstrate the Use of the PKSNote that PCE-2 may in some cases be co-located with ASBR-2 🏠.
2. Terminology 📚
- CPS: Confidential Path Segment. This is a segment of a path that has nodes and links the AS policy says must not be disclosed outside the AS 🤫.
- PCE: Path Computation Element. This is an entity (a component, an application, or a network node) that can compute a network path or route based on a network graph and apply computational constraints 🧮.
- PKS: Path Key Subobject. This is a subobject of an Explicit Route Object that encodes a CPS so confidentiality is preserved 🔑.
3. RSVP-TE Path Key Subobject ✨
The Path Key Subobject (PKS) can be carried in the Explicit Route Object (ERO) of an RSVP-TE Path message [RFC3209]. The PKS is a fixed-length subobject containing a Path Key and a PCE-ID 🎀. The Path Key is an identifier or token used to represent the CPS within the context of the PCE identified by the PCE-ID. The PCE-ID identifies the PCE that can decode the Path Key, using a reachable IPv4 or IPv6 address of that PCE 📍. In most cases, the decoding PCE is also the PCE that computed the Path Key and the associated path 💕. Because there are IPv4 and IPv6 variants, two subobjects are defined, and they look like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|L| Type | Length | Path Key |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PCE-ID (4 bytes) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: RSVP-TE Path Key Subobject using an
IPv4 address for the PCE-IDHere's the breakdown of the IPv4 version 🔍:
L: The L bit SHOULD NOT be set, so the subobject represents a strict hop in the explicit route 🚦.Type: This is the Subobject Type for a Path Key with a 32-bit PCE-ID, as assigned by IANA 🏷️.Length: The Length is the total length of the subobject in bytes, including the Type and Length fields. For this one, the Length is always 8 📏.PCE-ID: This is a 32-bit identifier of the PCE that can decode this key. The identifier MUST be unique within the scope of the domain that the CPS crosses, and it MUST be understood by the LSR that will act as PCC for the expansion of the PKS. How the PCE-ID gets interpreted is up to domain-local policy. It MAY be an IPv4 address of the PCE that is always reachable, and it MAY be an address restricted to the domain where the LSR that's called upon to expand the CPS lives. Other values that have no meaning outside the domain (for example, the Router ID of the PCE) MAY be used to increase security or confidentiality 🛡️.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|L| Type | Length | Path Key |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PCE-ID (16 bytes) |
| |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: RSVP-TE Path Key Subobject using an
IPv6 address for the PCE-IDAnd the IPv6 version 💜:
L: As above.Type: This is the Subobject Type for a Path Key with a 128-bit PCE-ID, as assigned by IANA 🏷️.Length: The Length is the total length of the subobject in bytes, including the Type and Length fields. For this one, the Length is always 20 📏.PCE-ID: This is a 128-bit identifier of the PCE that can decode this key. The identifier MUST be unique within the scope of the domain that the CPS crosses, and it MUST be understood by the LSR that will act as PCC for the expansion of the PKS. How the PCE-ID gets interpreted is up to domain-local policy. It MAY be an IPv6 address of the PCE that is always reachable, and it MAY be an address restricted to the domain where the LSR that's called upon to expand the CPS lives. Other values that have no meaning outside the domain (for example, the IPv6 TE Router ID) MAY be used to increase security (see Section 4) 🔒.
Note: The twins of these subobjects are carried in PCEP messages as defined in [RFC5520] 👯♀️. Part 1 ends here, bestie, so more RFC is coming up next! 🧚🌈
3.1. Explicit Route Object Processing Rules 🎀
Okay so the basic processing rules for an ERO? Totally unchanged, bestie 💅 Go check [RFC3209] for the details. The main thing is that an LSR is not required to "look ahead" in the ERO past the first subobject that is non-local 👀
[RFC5520] says that any path fragment a PCE generates that contains a PKS has to be set up so the PKS is immediately preceded by a subobject that identifies the head end of the PKS (like an incoming interface or a node ID) 🫶 This rule gets extended to the PKS in the ERO, so here's what we get:
- If an LSR receives a Path message where the first subobject of the ERO is a PKS, it MUST respond with a PathErr message carrying the error code/value combination "Routing Problem" / "Bad initial subobject". 😭
- If an LSR strips all local subobjects from an ERO carried in a Path message (according to the procedures in [RFC3209]) and finds that the next subobject is a PKS, it MUST attempt to resolve the PKS to a CPS. ✨
Resolution of the PKS MAY take any of the following forms or use some other technique subject to local policy and network implementation. 🧚
- The LSR can use the PCE-ID contained in the PKS to contact the identified PCE using PCEP [RFC5440] and request that the PKS be expanded.
- The LSR can contact any PCE using PCEP [RFC5440] to request that the PKS be expanded, relying on cooperation between the PCEs.
- The LSR can use the information in the PKS to index a CPS previously supplied to it by the PCE that originated the PKS.
If a CPS is derived, the path fragment SHOULD be inserted into the ERO of the Path message as a direct replacement for the PKS. Other processing of the CPS and ERO are permitted as described in [RFC3209]. 💖
This processing can give rise to the following error cases: 🙈
- PCE-ID cannot be matched to a PCE to decode the PKS.
The LSR sends a PathErr message with the error code "Routing Problem" and the new error value "Unknown PCE-ID for PKS expansion" (see Section 6.3).
- PCE identified by the PCE-ID cannot be reached.
The LSR sends a PathErr message with the error code "Routing Problem" and the new error value "Unreachable PCE for PKS expansion" (see Section 6.3).
- The PCE is unable to decode the PKS, perhaps because the Path Key has expired.
The LSR sends a PathErr message with the error code "Routing Problem" and the new error value "Unknown Path Key for PKS expansion" (see Section 6.3).
- PKS cannot be decoded for policy reasons.
The LSR sends a PathErr message with the error code "Policy Control Failure" and the error value "Inter-domain policy failure".
- Addition of CPS to ERO causes Path message to become too large.
The LSR MAY replace part of the ERO with loose hops [RFC3209] or with a further PKS, according to local policy, if the loss of specifics within the explicit path is acceptable. If the LSR is unable to take steps to reduce the size of the ERO, it MUST send a PathErr message with the error code "Routing Problem" and the new error value "ERO too large for MTU" (see Section 6.3). 🍓
- An LSR that is called on to process a PKS within an ERO but that does not recognize the subobject, will react according to [RFC3209] and send a PathErr message with the error code/value combination "Routing Problem" / "Bad Explicit Route Object". 💀
3.2. Reporting Path Key Segments in Record Route Objects 🦋
The Record Route Object (RRO) is the thing RSVP-TE uses to record the route an LSP actually took 🌸 It can show up on a Path message and on a Resv message. The whole point in [RFC3209] is that an RRO on a Resv message, once an ingress LSR gets it, is good enough to use as an ERO on a Path message that LSR sends, so you get an identical LSP. Iconic ✨
The PKS gives you a different option that can be way more useful for diagnostics 🔍 When the signaling message crosses a domain boundary, the path segment that needs to stay hidden (that's a CPS) MAY be swapped out in the RRO for a PKS. On an RRO in a Resv message, the PKS SHOULD be the one that was originally signaled in the ERO of the Path message. On a Path message, the PKS SHOULD identify the LSR doing the replacing and give a Path Key that can be used to expand the path segment. In that second case, the Path Key and its expansion SHOULD be kept by the LSR doing the substitution for at least the lifetime of the LSP. Either way, the expansion of the PKS SHOULD be made available to diagnostic tools under the control of local policy 🔐
4. Security Considerations 🔐
The protocol interactions the mechanisms in this document need are point-to-point, and they can be authenticated and made secure as described in [RFC5440] and [RFC3209]. The PCEP protocol interactions are listed in [RFC5520], and general considerations for securing RSVP-TE in MPLS-TE and GMPLS networks can be found in [MPLS-SEC].
So security issues can be handled with the usual techniques for securing and authenticating point-to-point communications. On top of that, it is RECOMMENDED that the PCE providing a PKS expansion checks that the LSR that asked for the PKS expansion is the head end of the resulting CPS. 🫶
More protection can come from using a PCE-ID to identify the decoding PCE, one that only means something inside the domain containing the LSR at the head of the CPS. That could be an IP address only reachable from inside the domain, or some non-address value. The first needs policy configured on the PCEs; the second needs domain-wide policy. 🌈
Here are the specific security issues you need to think about 👑
- Confidentiality of the CPS. The question to answer is whether other network elements can probe a PCE for the expansion of PKSs, possibly generating Path Keys at random. This can be guarded against by only letting PKS expansion complete successfully if the LSR at the head end of the resulting CPS requested it. Under specific circumstances, PKS expansion might also be allowed by configured management stations.
The CPS itself may be kept confidential, since it gets exchanged in the PCEP and RSVP-TE protocols using the standard security mechanisms defined for those protocols.
- Determination of information by probing. On top of the probing described above, a node might deduce information from the error responses generated when PKS expansion fails, as described in Section 3.1. Any LSR that decides that sending one of the detailed error codes from Section 3.1 might give away too much information that could be used in a systematic attack MAY simply use the error code/value "Policy Control Failure" / "Inter-domain policy failure" in all cases. 🕵️
- Authenticity of the Path Key. The worry is that the Path Key in the PKS gets altered or faked, leading to bad Path Key expansion and use of the wrong CPS. The result would be a bad ERO in a Path message, which would cause the LSP to be set up incorrectly and lead to incorrect network resource usage, diversion of traffic to where it can be intercepted, or failure to set up the LSP. These problems can be prevented by protecting the protocol exchanges in PCEP and RSVP-TE with the security techniques described in [RFC5440], [RFC3209], and [MPLS-SEC]. 😱
- Resilience to denial-of-service (DoS) attacks. A PCE can be attacked through a flood of Path Key expansion requests. This issue is addressed in [RFC5520] and is out of scope for this document. Another attack might be sending a flood of RSVP-TE Path messages with deliberately spurious PKSs. This attack is prevented by making sure the integrity of the Path messages is ensured using standard RSVP-TE security mechanisms and by enforcing the RSVP-TE chain-of-trust security model. 🚨
5. Manageability Considerations 🛠️
5.1. Control of Function through Configuration and Policy 🎛️
Policy is a huge part of using PKSs in EROs and RROs 💅 There are local and domain-wide policies that SHOULD be available for configuration in an implementation.
- Handling of an ERO containing a PKS. As described in Section 3.1, an LSR that receives a Path message containing a PKS can be configured to reject the Path message according to policy.
- Handling of PKS requests at a PCE. As described in Section 3.1, in [RFC5520], and in [RFC5394], a PCE can be configured with policy about how it should handle requests for PKS expansion.
- PKS expansion. Section 3.1 explains that the PKS can be expanded by the local LSR, the specific PCE identified in the PKS, any PCE acting as a proxy, or by some other method. The behavior of the LSR needs to be locally configurable but is subject to the domain-wide policy.
- Interpretation of PCE-ID. How the PCE-ID component of PKSs gets interpreted is subject to domain-local policy and needs to be configurable as such. See Section 3 and Section 4 for the options.
- ERO too large. What an LSR does when it finds that adding a CPS to the ERO makes the Path message too large is an implementation choice. However, implementations may choose to provide configuration of behavior as described in Section 3.1.
- Masking of RRO. As described in Section 3.2, a border router can choose to mask segments of the path by replacing them with PKSs. This behavior needs to be configurable, with the default being to not hide any part of the RRO. 🙈
- Inspection / decoding of PKS by diagnostic tools. A PCE can allow access from management or diagnostic tools to request the expansion of a PKS. Note that this must be regulated with the security and confidentiality behavior described in Section 4. 🔎
- Hiding of reason codes. An LSR can support the configuration of local policy to hide reason codes associated with the failure to expand a PKS and, as described in Section 4, report all errors as policy failures.
The treatment of a path segment as a CPS, and its substitution in a PCRep ERO with a PKS, is a PCE function and is described in [RFC5520]. 🧚
6. IANA Considerations 📋
6.1. Explicit Route Object Subobjects 🌷
IANA maintains a registry called "Resource Reservation Protocol (RSVP) Parameters" with a subregistry called "Class Names, Class Numbers, and Class Types".
Within this subregistry, there's a definition of the EXPLICIT_ROUTE object with Class Number 20. The object definition lists a number of acceptable subobjects for the Class Type 1.
IANA has allocated two further subobjects as described in Section 3. The resulting entry in the registry is as follows.
20 EXPLICIT_ROUTE [RFC3209]
Class Types or C-Types:
1 Type 1 Explicit Route [RFC3209]
Subobject type
64 Path Key with 32-bit PCE-ID [RFC5553]
65 Path Key with 128-bit PCE-ID [RFC5553]Note well: [RFC5520] defines the PKS for use in PCEP. IANA has assigned the same subobject numbers for use in RSVP-TE as are assigned for the PKS in PCEP. The numbers above are the same as in [RFC5520]. 👀✨
6.2. Record Route Objects Subobjects ✨
okay so IANA keeps a registry called "Resource Reservation Protocol (RSVP) Parameters" 🎀, and inside it is a subregistry called "Class Names, Class Numbers, and Class Types" 💖. In there, the ROUTE_RECORD object (aka RECORD_ROUTE 🧚) is listed with Class Number 21, and its definition has a bunch of acceptable subobjects for Class Type 1 🌸.
IANA has added two more subobjects, which are described in Section 3 🦋. Here's what the registry entry looks like now:
21 ROUTE_RECORD [RFC3209]
(also known as RECORD_ROUTE)
Class Types or C-Types:
1 Type 1 Route Record [RFC3209]
Subobject type
64 Path Key with 32-bit PCE-ID [RFC5553]
65 Path Key with 128-bit PCE-ID [RFC5553]Note well 👀: IANA is requested to use the same subobject numbers that are defined for the EXPLICIT_ROUTE object in Section 6.1. Keep those numbers matching, bestie, no exceptions 💅.
6.3. Error Codes and Error Values 💜
Same vibe here 🌈. IANA maintains a registry called "Resource Reservation Protocol (RSVP) Parameters," and this time the subregistry is called "Error Codes and Globally-Defined Error Value Sub-Codes" 🔥.
Inside it, the "Routing Problem" error code is defined with error code value 24 ⭐. Its definition lists a few error values that can be used with this code.
IANA has also allocated more error values for this error code, as described in Section 3.1 ✨. The resulting registry entry is below 👑:
24 Routing Problem [RFC3209]
This Error Code has the following globally defined Error
Value sub-codes:
31 = Unknown PCE-ID for PKS expansion [RFC5553]
32 = Unreachable PCE for PKS expansion [RFC5553]
33 = Unknown Path Key for PKS expansion [RFC5553]
34 = ERO too large for MTU [RFC5553]7. References 📚
7.1. Normative References 🫶
- [RFC2119]: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. This is the one that defines all the requirement-level key words, so it's giving foundational 💅.
- [RFC3209]: Awduche, D., Berger, L., Gan, D., Li, T., Srinivasan, V., and G. Swallow, "RSVP-TE: Extensions to RSVP for LSP Tunnels", RFC 3209, December 2001. The RSVP-TE base, obsessed 🦋.
- [RFC3473]: Berger, L., Ed., "Generalized Multi-Protocol Label Switching (GMPLS) Signaling Resource ReserVation Protocol-Traffic Engineering (RSVP-TE) Extensions", RFC 3473, January 2003. The GMPLS version of RSVP-TE 🌸.
7.2. Informative References 🌷
- [RFC4655]: Farrel, A., Vasseur, J.-P., and J. Ash, "A Path Computation Element (PCE)-Based Architecture", RFC 4655, August 2006. The PCE architecture, the big picture 🧚.
- [RFC4726]: Farrel, A., Vasseur, J.-P., and A. Ayyangar, "A Framework for Inter-Domain Multiprotocol Label Switching Traffic Engineering", RFC 4726, November 2006. Inter-domain TE framework, lowkey essential 🍓.
- [RFC5394]: Bryskin, I., Papadimitriou, D., Berger, L., and J. Ash, "Policy-Enabled Path Computation Framework", RFC 5394, December 2008. Policy meets path computation, iconic 👑.
- [RFC5440]: Vasseur, JP., Ed., and JL. Le Roux, Ed., "Path Computation Element (PCE) Communication Protocol (PCEP)", RFC 5440, March 2009. The PCEP protocol itself, no cap 🔥.
- [RFC5520]: Bradford, R., Ed., Vasseur, JP., and A. Farrel, "Preserving Topology Confidentiality in Inter-Domain Path Computation Using a Path-Key-Based Mechanism", RFC 5520, April 2009. This is the path-key idea that keeps topology private, and it's the reason we're all here 🦋✨.
- [MPLS-SEC]: Fang, L., Ed., "Security Framework for MPLS and GMPLS Networks", Work in Progress, March 2009. A draft that was still in progress when this went out 💀.
Authors' Addresses 💖
- Adrian Farrel, Old Dog Consulting, EMail: adrian@olddog.co.uk 🧚
- Rich Bradford, Cisco Systems, Inc., 1414 Massachusetts Avenue, Boxborough, MA - 01719, USA, EMail: rbradfor@cisco.com 🌸
- Jean-Philippe Vasseur, Cisco Systems, Inc, 11, Rue Camille Desmoulins, L'Atlantis, 92782 Issy Les Moulineaux, France, EMail: jpv@cisco.com 🫶
📦 where this page comes from
- ietf: rfc5553 2009-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms